@immediately-run/sdk 0.59.0 → 0.59.1

package/dist/components/Link.cjs

@@ -29,22 +29,29 @@ var import_routing = require("../routing");
 var import_scrollToId = require("../scrollToId");
 var import_TinkerableContext = require("../TinkerableContext");
 var import_urlUtils = require("../urlUtils");
+const useComposedAnchorClick = (onClick, intercept, interceptDeps) => (0, import_react.useCallback)(
+  (e) => {
+    onClick?.(e);
+    if (e.defaultPrevented) return;
+    intercept(e);
+  },
+  [onClick, ...interceptDeps]
+);
 const FragmentLink = ({
   href,
   children,
   onClick,
   ...props
 }) => {
-  const clickHandler = (0, import_react.useCallback)(
+  const clickHandler = useComposedAnchorClick(
+    onClick,
     (e) => {
-      onClick?.(e);
-      if (e.defaultPrevented) return;
       if (href && href.startsWith("#")) {
         e.preventDefault();
         (0, import_scrollToId.scrollToId)(href.slice(1));
       }
     },
-    [href, onClick]
+    [href]
   );
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { href, onClick: clickHandler, ...props, children });
 };
@@ -55,17 +62,16 @@ const InternalLink = ({
   target,
   ...props
 }) => {
-  const clickHandler = (0, import_react.useCallback)(
+  const clickHandler = useComposedAnchorClick(
+    onClick,
     (e) => {
-      onClick?.(e);
-      if (e.defaultPrevented) return;
       if (!href) return;
       if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey || e.button !== 0) return;
       if (target && target !== "_self") return;
       e.preventDefault();
       (0, import_routing.navigate)(href);
     },
-    [href, onClick, target]
+    [href, target]
   );
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { ...props, href, target, onClick: clickHandler, children });
 };

package/dist/components/Link.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/Link.tsx"],"sourcesContent":["import { ReactNode, use, useCallback } from 'react';\nimport { navigate } from '../routing';\nimport { scrollToId } from '../scrollToId';\nimport { TinkerableContext } from '../TinkerableContext';\nimport { constructOuterUrl, isInternalHref } from '../urlUtils';\n\n/** A same-page anchor (`#frag`): scrolls the addressed section into view on click\n *  **without a route change** (MARKDOWN_SYNTAX_SPEC §13.5). The default behavior of a\n *  bare `#`-href is intercepted so the sandbox URL the host owns is never mutated\n *  out from under it; a fragment that names nothing leaves the scroll position\n *  untouched (a soft failure). */\nexport const FragmentLink = ({\n  href,\n  children,\n  onClick,\n  ...props\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const clickHandler = useCallback(\n    (e: React.MouseEvent<HTMLAnchorElement>) => {\n      onClick?.(e);\n      if (e.defaultPrevented) return;\n      if (href && href.startsWith('#')) {\n        e.preventDefault();\n        scrollToId(href.slice(1));\n      }\n    },\n    [href, onClick],\n  );\n  return (\n    <a href={href} onClick={clickHandler} {...props}>\n      {children}\n    </a>\n  );\n};\n\n/** An `<a>` that performs in-sandbox navigation on click (prevents the default\n *  full-page load and routes via {@link navigate}).\n *\n *  A consumer-supplied `onClick` is COMPOSED with the router interception, never\n *  substituted for it (the {@link FragmentLink} contract): it runs first, and\n *  calling `preventDefault()` opts out of routing. Regression guard: `...props`\n *  used to spread AFTER `onClick={clickHandler}`, so a consumer `onClick` (e.g. a\n *  drawer's close-on-navigate) silently REPLACED the interception — the default\n *  anchor action then navigated the sandboxed iframe itself to the host URL,\n *  reloading the whole app (and framing the host inside its own sandbox).\n *\n *  Modifier/middle clicks and explicit non-self `target`s keep the browser\n *  default: the rendered href is a real host URL, so open-in-new-tab works. */\nexport const InternalLink = ({\n  href,\n  children,\n  onClick,\n  target,\n  ...props\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const clickHandler = useCallback(\n    (e: React.MouseEvent<HTMLAnchorElement>) => {\n      onClick?.(e);\n      if (e.defaultPrevented) return;\n      if (!href) return;\n      // Open-in-new-tab gestures (and an explicit target) are the browser's.\n      if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey || e.button !== 0) return;\n      if (target && target !== '_self') return;\n      e.preventDefault();\n      navigate(href);\n    },\n    [href, onClick, target],\n  );\n  // Spread FIRST so no forwarded prop can clobber the interception or the href.\n  return (\n    <a {...props} href={href} target={target} onClick={clickHandler}>\n      {children}\n    </a>\n  );\n};\n\n/** A link that routes same-app hrefs through the sandbox router (as an\n *  {@link InternalLink}) and renders external hrefs as a plain `<a>`. */\nexport const Link = ({\n  href,\n  children,\n  ...properties\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const { outerHref, navigationState } = use(TinkerableContext);\n  // A pure same-page fragment (`#sec-8-9`) scrolls in place — no route change (§13.5).\n  if (href && href.startsWith('#')) {\n    return (\n      <FragmentLink href={href} {...properties}>\n        {children}\n      </FragmentLink>\n    );\n  }\n  if (href && isInternalHref(outerHref, href, navigationState)) {\n    const targetHref = constructOuterUrl(outerHref, href, navigationState);\n    return (\n      <InternalLink href={targetHref} {...properties}>\n        {children}\n      </InternalLink>\n    );\n  } else {\n    // create a regular link to external resource\n    return <a {...{ href, ...properties }}>{children}</a>;\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6BI;AA7BJ,mBAA4C;AAC5C,qBAAyB;AACzB,wBAA2B;AAC3B,+BAAkC;AAClC,sBAAkD;AAO3C,MAAM,eAAe,CAAC;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,mBAAe;AAAA,IACnB,CAAC,MAA2C;AAC1C,gBAAU,CAAC;AACX,UAAI,EAAE,iBAAkB;AACxB,UAAI,QAAQ,KAAK,WAAW,GAAG,GAAG;AAChC,UAAE,eAAe;AACjB,0CAAW,KAAK,MAAM,CAAC,CAAC;AAAA,MAC1B;AAAA,IACF;AAAA,IACA,CAAC,MAAM,OAAO;AAAA,EAChB;AACA,SACE,4CAAC,OAAE,MAAY,SAAS,cAAe,GAAG,OACvC,UACH;AAEJ;AAeO,MAAM,eAAe,CAAC;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,mBAAe;AAAA,IACnB,CAAC,MAA2C;AAC1C,gBAAU,CAAC;AACX,UAAI,EAAE,iBAAkB;AACxB,UAAI,CAAC,KAAM;AAEX,UAAI,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAG;AACxE,UAAI,UAAU,WAAW,QAAS;AAClC,QAAE,eAAe;AACjB,mCAAS,IAAI;AAAA,IACf;AAAA,IACA,CAAC,MAAM,SAAS,MAAM;AAAA,EACxB;AAEA,SACE,4CAAC,OAAG,GAAG,OAAO,MAAY,QAAgB,SAAS,cAChD,UACH;AAEJ;AAIO,MAAM,OAAO,CAAC;AAAA,EACnB;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,EAAE,WAAW,gBAAgB,QAAI,kBAAI,0CAAiB;AAE5D,MAAI,QAAQ,KAAK,WAAW,GAAG,GAAG;AAChC,WACE,4CAAC,gBAAa,MAAa,GAAG,YAC3B,UACH;AAAA,EAEJ;AACA,MAAI,YAAQ,gCAAe,WAAW,MAAM,eAAe,GAAG;AAC5D,UAAM,iBAAa,mCAAkB,WAAW,MAAM,eAAe;AACrE,WACE,4CAAC,gBAAa,MAAM,YAAa,GAAG,YACjC,UACH;AAAA,EAEJ,OAAO;AAEL,WAAO,4CAAC,OAAG,GAAG,EAAE,MAAM,GAAG,WAAW,GAAI,UAAS;AAAA,EACnD;AACF;","names":[]}
+{"version":3,"sources":["../../src/components/Link.tsx"],"sourcesContent":["import { ReactNode, use, useCallback } from 'react';\nimport { navigate } from '../routing';\nimport { scrollToId } from '../scrollToId';\nimport { TinkerableContext } from '../TinkerableContext';\nimport { constructOuterUrl, isInternalHref } from '../urlUtils';\n\n/** The click contract shared by this module's link primitives: a consumer-supplied\n *  `onClick` is COMPOSED with the interception, never substituted for it. The\n *  consumer handler runs FIRST and calling `preventDefault()` in it opts the click\n *  out of the interception entirely; otherwise `intercept` runs. Both primitives\n *  spelled this out inline until they were one named contract, which is how they\n *  drifted apart once already (see {@link InternalLink}).\n *\n *  `intercept` is re-created on every render, so it is deliberately NOT a\n *  dependency: `interceptDeps` names the values it closes over, and the memo is\n *  invalidated exactly when those change — the dependency set each call site had\n *  when it wrote the handler out by hand. */\nconst useComposedAnchorClick = (\n  onClick: React.MouseEventHandler<HTMLAnchorElement> | undefined,\n  intercept: (e: React.MouseEvent<HTMLAnchorElement>) => void,\n  interceptDeps: React.DependencyList,\n): React.MouseEventHandler<HTMLAnchorElement> =>\n  useCallback(\n    (e: React.MouseEvent<HTMLAnchorElement>) => {\n      onClick?.(e);\n      if (e.defaultPrevented) return;\n      intercept(e);\n    },\n    [onClick, ...interceptDeps],\n  );\n\n/** A same-page anchor (`#frag`): scrolls the addressed section into view on click\n *  **without a route change** (MARKDOWN_SYNTAX_SPEC §13.5). The default behavior of a\n *  bare `#`-href is intercepted so the sandbox URL the host owns is never mutated\n *  out from under it; a fragment that names nothing leaves the scroll position\n *  untouched (a soft failure). */\nexport const FragmentLink = ({\n  href,\n  children,\n  onClick,\n  ...props\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const clickHandler = useComposedAnchorClick(\n    onClick,\n    (e) => {\n      if (href && href.startsWith('#')) {\n        e.preventDefault();\n        scrollToId(href.slice(1));\n      }\n    },\n    [href],\n  );\n  return (\n    <a href={href} onClick={clickHandler} {...props}>\n      {children}\n    </a>\n  );\n};\n\n/** An `<a>` that performs in-sandbox navigation on click (prevents the default\n *  full-page load and routes via {@link navigate}).\n *\n *  A consumer-supplied `onClick` is COMPOSED with the router interception, never\n *  substituted for it (`useComposedAnchorClick` above): it runs first, and\n *  calling `preventDefault()` opts out of routing. Regression guard: `...props`\n *  used to spread AFTER `onClick={clickHandler}`, so a consumer `onClick` (e.g. a\n *  drawer's close-on-navigate) silently REPLACED the interception — the default\n *  anchor action then navigated the sandboxed iframe itself to the host URL,\n *  reloading the whole app (and framing the host inside its own sandbox).\n *\n *  Modifier/middle clicks and explicit non-self `target`s keep the browser\n *  default: the rendered href is a real host URL, so open-in-new-tab works. */\nexport const InternalLink = ({\n  href,\n  children,\n  onClick,\n  target,\n  ...props\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const clickHandler = useComposedAnchorClick(\n    onClick,\n    (e) => {\n      if (!href) return;\n      // Open-in-new-tab gestures (and an explicit target) are the browser's.\n      if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey || e.button !== 0) return;\n      if (target && target !== '_self') return;\n      e.preventDefault();\n      navigate(href);\n    },\n    [href, target],\n  );\n  // Spread FIRST so no forwarded prop can clobber the interception or the href.\n  return (\n    <a {...props} href={href} target={target} onClick={clickHandler}>\n      {children}\n    </a>\n  );\n};\n\n/** A link that routes same-app hrefs through the sandbox router (as an\n *  {@link InternalLink}) and renders external hrefs as a plain `<a>`. */\nexport const Link = ({\n  href,\n  children,\n  ...properties\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const { outerHref, navigationState } = use(TinkerableContext);\n  // A pure same-page fragment (`#sec-8-9`) scrolls in place — no route change (§13.5).\n  if (href && href.startsWith('#')) {\n    return (\n      <FragmentLink href={href} {...properties}>\n        {children}\n      </FragmentLink>\n    );\n  }\n  if (href && isInternalHref(outerHref, href, navigationState)) {\n    const targetHref = constructOuterUrl(outerHref, href, navigationState);\n    return (\n      <InternalLink href={targetHref} {...properties}>\n        {children}\n      </InternalLink>\n    );\n  } else {\n    // create a regular link to external resource\n    return <a {...{ href, ...properties }}>{children}</a>;\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqDI;AArDJ,mBAA4C;AAC5C,qBAAyB;AACzB,wBAA2B;AAC3B,+BAAkC;AAClC,sBAAkD;AAalD,MAAM,yBAAyB,CAC7B,SACA,WACA,sBAEA;AAAA,EACE,CAAC,MAA2C;AAC1C,cAAU,CAAC;AACX,QAAI,EAAE,iBAAkB;AACxB,cAAU,CAAC;AAAA,EACb;AAAA,EACA,CAAC,SAAS,GAAG,aAAa;AAC5B;AAOK,MAAM,eAAe,CAAC;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,CAAC,MAAM;AACL,UAAI,QAAQ,KAAK,WAAW,GAAG,GAAG;AAChC,UAAE,eAAe;AACjB,0CAAW,KAAK,MAAM,CAAC,CAAC;AAAA,MAC1B;AAAA,IACF;AAAA,IACA,CAAC,IAAI;AAAA,EACP;AACA,SACE,4CAAC,OAAE,MAAY,SAAS,cAAe,GAAG,OACvC,UACH;AAEJ;AAeO,MAAM,eAAe,CAAC;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,CAAC,MAAM;AACL,UAAI,CAAC,KAAM;AAEX,UAAI,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAG;AACxE,UAAI,UAAU,WAAW,QAAS;AAClC,QAAE,eAAe;AACjB,mCAAS,IAAI;AAAA,IACf;AAAA,IACA,CAAC,MAAM,MAAM;AAAA,EACf;AAEA,SACE,4CAAC,OAAG,GAAG,OAAO,MAAY,QAAgB,SAAS,cAChD,UACH;AAEJ;AAIO,MAAM,OAAO,CAAC;AAAA,EACnB;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,EAAE,WAAW,gBAAgB,QAAI,kBAAI,0CAAiB;AAE5D,MAAI,QAAQ,KAAK,WAAW,GAAG,GAAG;AAChC,WACE,4CAAC,gBAAa,MAAa,GAAG,YAC3B,UACH;AAAA,EAEJ;AACA,MAAI,YAAQ,gCAAe,WAAW,MAAM,eAAe,GAAG;AAC5D,UAAM,iBAAa,mCAAkB,WAAW,MAAM,eAAe;AACrE,WACE,4CAAC,gBAAa,MAAM,YAAa,GAAG,YACjC,UACH;AAAA,EAEJ,OAAO;AAEL,WAAO,4CAAC,OAAG,GAAG,EAAE,MAAM,GAAG,WAAW,GAAI,UAAS;AAAA,EACnD;AACF;","names":[]}

package/dist/components/Link.d.cts

@@ -10,7 +10,7 @@ declare const FragmentLink: ({ href, children, onClick, ...props }: React.Detail
  *  full-page load and routes via {@link navigate}).
  *
  *  A consumer-supplied `onClick` is COMPOSED with the router interception, never
- *  substituted for it (the {@link FragmentLink} contract): it runs first, and
+ *  substituted for it (`useComposedAnchorClick` above): it runs first, and
  *  calling `preventDefault()` opts out of routing. Regression guard: `...props`
  *  used to spread AFTER `onClick={clickHandler}`, so a consumer `onClick` (e.g. a
  *  drawer's close-on-navigate) silently REPLACED the interception — the default

package/dist/components/Link.d.ts

@@ -10,7 +10,7 @@ declare const FragmentLink: ({ href, children, onClick, ...props }: React.Detail
  *  full-page load and routes via {@link navigate}).
  *
  *  A consumer-supplied `onClick` is COMPOSED with the router interception, never
- *  substituted for it (the {@link FragmentLink} contract): it runs first, and
+ *  substituted for it (`useComposedAnchorClick` above): it runs first, and
  *  calling `preventDefault()` opts out of routing. Regression guard: `...props`
  *  used to spread AFTER `onClick={clickHandler}`, so a consumer `onClick` (e.g. a
  *  drawer's close-on-navigate) silently REPLACED the interception — the default

package/dist/components/Link.js

@@ -5,22 +5,29 @@ import { navigate } from "../routing";
 import { scrollToId } from "../scrollToId";
 import { TinkerableContext } from "../TinkerableContext";
 import { constructOuterUrl, isInternalHref } from "../urlUtils";
+const useComposedAnchorClick = (onClick, intercept, interceptDeps) => useCallback(
+  (e) => {
+    onClick?.(e);
+    if (e.defaultPrevented) return;
+    intercept(e);
+  },
+  [onClick, ...interceptDeps]
+);
 const FragmentLink = ({
   href,
   children,
   onClick,
   ...props
 }) => {
-  const clickHandler = useCallback(
+  const clickHandler = useComposedAnchorClick(
+    onClick,
     (e) => {
-      onClick?.(e);
-      if (e.defaultPrevented) return;
       if (href && href.startsWith("#")) {
         e.preventDefault();
         scrollToId(href.slice(1));
       }
     },
-    [href, onClick]
+    [href]
   );
   return /* @__PURE__ */ jsx("a", { href, onClick: clickHandler, ...props, children });
 };
@@ -31,17 +38,16 @@ const InternalLink = ({
   target,
   ...props
 }) => {
-  const clickHandler = useCallback(
+  const clickHandler = useComposedAnchorClick(
+    onClick,
     (e) => {
-      onClick?.(e);
-      if (e.defaultPrevented) return;
       if (!href) return;
       if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey || e.button !== 0) return;
       if (target && target !== "_self") return;
       e.preventDefault();
       navigate(href);
     },
-    [href, onClick, target]
+    [href, target]
   );
   return /* @__PURE__ */ jsx("a", { ...props, href, target, onClick: clickHandler, children });
 };

package/dist/components/Link.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/Link.tsx"],"sourcesContent":["import { ReactNode, use, useCallback } from 'react';\nimport { navigate } from '../routing';\nimport { scrollToId } from '../scrollToId';\nimport { TinkerableContext } from '../TinkerableContext';\nimport { constructOuterUrl, isInternalHref } from '../urlUtils';\n\n/** A same-page anchor (`#frag`): scrolls the addressed section into view on click\n *  **without a route change** (MARKDOWN_SYNTAX_SPEC §13.5). The default behavior of a\n *  bare `#`-href is intercepted so the sandbox URL the host owns is never mutated\n *  out from under it; a fragment that names nothing leaves the scroll position\n *  untouched (a soft failure). */\nexport const FragmentLink = ({\n  href,\n  children,\n  onClick,\n  ...props\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const clickHandler = useCallback(\n    (e: React.MouseEvent<HTMLAnchorElement>) => {\n      onClick?.(e);\n      if (e.defaultPrevented) return;\n      if (href && href.startsWith('#')) {\n        e.preventDefault();\n        scrollToId(href.slice(1));\n      }\n    },\n    [href, onClick],\n  );\n  return (\n    <a href={href} onClick={clickHandler} {...props}>\n      {children}\n    </a>\n  );\n};\n\n/** An `<a>` that performs in-sandbox navigation on click (prevents the default\n *  full-page load and routes via {@link navigate}).\n *\n *  A consumer-supplied `onClick` is COMPOSED with the router interception, never\n *  substituted for it (the {@link FragmentLink} contract): it runs first, and\n *  calling `preventDefault()` opts out of routing. Regression guard: `...props`\n *  used to spread AFTER `onClick={clickHandler}`, so a consumer `onClick` (e.g. a\n *  drawer's close-on-navigate) silently REPLACED the interception — the default\n *  anchor action then navigated the sandboxed iframe itself to the host URL,\n *  reloading the whole app (and framing the host inside its own sandbox).\n *\n *  Modifier/middle clicks and explicit non-self `target`s keep the browser\n *  default: the rendered href is a real host URL, so open-in-new-tab works. */\nexport const InternalLink = ({\n  href,\n  children,\n  onClick,\n  target,\n  ...props\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const clickHandler = useCallback(\n    (e: React.MouseEvent<HTMLAnchorElement>) => {\n      onClick?.(e);\n      if (e.defaultPrevented) return;\n      if (!href) return;\n      // Open-in-new-tab gestures (and an explicit target) are the browser's.\n      if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey || e.button !== 0) return;\n      if (target && target !== '_self') return;\n      e.preventDefault();\n      navigate(href);\n    },\n    [href, onClick, target],\n  );\n  // Spread FIRST so no forwarded prop can clobber the interception or the href.\n  return (\n    <a {...props} href={href} target={target} onClick={clickHandler}>\n      {children}\n    </a>\n  );\n};\n\n/** A link that routes same-app hrefs through the sandbox router (as an\n *  {@link InternalLink}) and renders external hrefs as a plain `<a>`. */\nexport const Link = ({\n  href,\n  children,\n  ...properties\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const { outerHref, navigationState } = use(TinkerableContext);\n  // A pure same-page fragment (`#sec-8-9`) scrolls in place — no route change (§13.5).\n  if (href && href.startsWith('#')) {\n    return (\n      <FragmentLink href={href} {...properties}>\n        {children}\n      </FragmentLink>\n    );\n  }\n  if (href && isInternalHref(outerHref, href, navigationState)) {\n    const targetHref = constructOuterUrl(outerHref, href, navigationState);\n    return (\n      <InternalLink href={targetHref} {...properties}>\n        {children}\n      </InternalLink>\n    );\n  } else {\n    // create a regular link to external resource\n    return <a {...{ href, ...properties }}>{children}</a>;\n  }\n};\n"],"mappings":";AA6BI;AA7BJ,SAAoB,KAAK,mBAAmB;AAC5C,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,yBAAyB;AAClC,SAAS,mBAAmB,sBAAsB;AAO3C,MAAM,eAAe,CAAC;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,eAAe;AAAA,IACnB,CAAC,MAA2C;AAC1C,gBAAU,CAAC;AACX,UAAI,EAAE,iBAAkB;AACxB,UAAI,QAAQ,KAAK,WAAW,GAAG,GAAG;AAChC,UAAE,eAAe;AACjB,mBAAW,KAAK,MAAM,CAAC,CAAC;AAAA,MAC1B;AAAA,IACF;AAAA,IACA,CAAC,MAAM,OAAO;AAAA,EAChB;AACA,SACE,oBAAC,OAAE,MAAY,SAAS,cAAe,GAAG,OACvC,UACH;AAEJ;AAeO,MAAM,eAAe,CAAC;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,eAAe;AAAA,IACnB,CAAC,MAA2C;AAC1C,gBAAU,CAAC;AACX,UAAI,EAAE,iBAAkB;AACxB,UAAI,CAAC,KAAM;AAEX,UAAI,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAG;AACxE,UAAI,UAAU,WAAW,QAAS;AAClC,QAAE,eAAe;AACjB,eAAS,IAAI;AAAA,IACf;AAAA,IACA,CAAC,MAAM,SAAS,MAAM;AAAA,EACxB;AAEA,SACE,oBAAC,OAAG,GAAG,OAAO,MAAY,QAAgB,SAAS,cAChD,UACH;AAEJ;AAIO,MAAM,OAAO,CAAC;AAAA,EACnB;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,EAAE,WAAW,gBAAgB,IAAI,IAAI,iBAAiB;AAE5D,MAAI,QAAQ,KAAK,WAAW,GAAG,GAAG;AAChC,WACE,oBAAC,gBAAa,MAAa,GAAG,YAC3B,UACH;AAAA,EAEJ;AACA,MAAI,QAAQ,eAAe,WAAW,MAAM,eAAe,GAAG;AAC5D,UAAM,aAAa,kBAAkB,WAAW,MAAM,eAAe;AACrE,WACE,oBAAC,gBAAa,MAAM,YAAa,GAAG,YACjC,UACH;AAAA,EAEJ,OAAO;AAEL,WAAO,oBAAC,OAAG,GAAG,EAAE,MAAM,GAAG,WAAW,GAAI,UAAS;AAAA,EACnD;AACF;","names":[]}
+{"version":3,"sources":["../../src/components/Link.tsx"],"sourcesContent":["import { ReactNode, use, useCallback } from 'react';\nimport { navigate } from '../routing';\nimport { scrollToId } from '../scrollToId';\nimport { TinkerableContext } from '../TinkerableContext';\nimport { constructOuterUrl, isInternalHref } from '../urlUtils';\n\n/** The click contract shared by this module's link primitives: a consumer-supplied\n *  `onClick` is COMPOSED with the interception, never substituted for it. The\n *  consumer handler runs FIRST and calling `preventDefault()` in it opts the click\n *  out of the interception entirely; otherwise `intercept` runs. Both primitives\n *  spelled this out inline until they were one named contract, which is how they\n *  drifted apart once already (see {@link InternalLink}).\n *\n *  `intercept` is re-created on every render, so it is deliberately NOT a\n *  dependency: `interceptDeps` names the values it closes over, and the memo is\n *  invalidated exactly when those change — the dependency set each call site had\n *  when it wrote the handler out by hand. */\nconst useComposedAnchorClick = (\n  onClick: React.MouseEventHandler<HTMLAnchorElement> | undefined,\n  intercept: (e: React.MouseEvent<HTMLAnchorElement>) => void,\n  interceptDeps: React.DependencyList,\n): React.MouseEventHandler<HTMLAnchorElement> =>\n  useCallback(\n    (e: React.MouseEvent<HTMLAnchorElement>) => {\n      onClick?.(e);\n      if (e.defaultPrevented) return;\n      intercept(e);\n    },\n    [onClick, ...interceptDeps],\n  );\n\n/** A same-page anchor (`#frag`): scrolls the addressed section into view on click\n *  **without a route change** (MARKDOWN_SYNTAX_SPEC §13.5). The default behavior of a\n *  bare `#`-href is intercepted so the sandbox URL the host owns is never mutated\n *  out from under it; a fragment that names nothing leaves the scroll position\n *  untouched (a soft failure). */\nexport const FragmentLink = ({\n  href,\n  children,\n  onClick,\n  ...props\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const clickHandler = useComposedAnchorClick(\n    onClick,\n    (e) => {\n      if (href && href.startsWith('#')) {\n        e.preventDefault();\n        scrollToId(href.slice(1));\n      }\n    },\n    [href],\n  );\n  return (\n    <a href={href} onClick={clickHandler} {...props}>\n      {children}\n    </a>\n  );\n};\n\n/** An `<a>` that performs in-sandbox navigation on click (prevents the default\n *  full-page load and routes via {@link navigate}).\n *\n *  A consumer-supplied `onClick` is COMPOSED with the router interception, never\n *  substituted for it (`useComposedAnchorClick` above): it runs first, and\n *  calling `preventDefault()` opts out of routing. Regression guard: `...props`\n *  used to spread AFTER `onClick={clickHandler}`, so a consumer `onClick` (e.g. a\n *  drawer's close-on-navigate) silently REPLACED the interception — the default\n *  anchor action then navigated the sandboxed iframe itself to the host URL,\n *  reloading the whole app (and framing the host inside its own sandbox).\n *\n *  Modifier/middle clicks and explicit non-self `target`s keep the browser\n *  default: the rendered href is a real host URL, so open-in-new-tab works. */\nexport const InternalLink = ({\n  href,\n  children,\n  onClick,\n  target,\n  ...props\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const clickHandler = useComposedAnchorClick(\n    onClick,\n    (e) => {\n      if (!href) return;\n      // Open-in-new-tab gestures (and an explicit target) are the browser's.\n      if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey || e.button !== 0) return;\n      if (target && target !== '_self') return;\n      e.preventDefault();\n      navigate(href);\n    },\n    [href, target],\n  );\n  // Spread FIRST so no forwarded prop can clobber the interception or the href.\n  return (\n    <a {...props} href={href} target={target} onClick={clickHandler}>\n      {children}\n    </a>\n  );\n};\n\n/** A link that routes same-app hrefs through the sandbox router (as an\n *  {@link InternalLink}) and renders external hrefs as a plain `<a>`. */\nexport const Link = ({\n  href,\n  children,\n  ...properties\n}: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>): ReactNode => {\n  const { outerHref, navigationState } = use(TinkerableContext);\n  // A pure same-page fragment (`#sec-8-9`) scrolls in place — no route change (§13.5).\n  if (href && href.startsWith('#')) {\n    return (\n      <FragmentLink href={href} {...properties}>\n        {children}\n      </FragmentLink>\n    );\n  }\n  if (href && isInternalHref(outerHref, href, navigationState)) {\n    const targetHref = constructOuterUrl(outerHref, href, navigationState);\n    return (\n      <InternalLink href={targetHref} {...properties}>\n        {children}\n      </InternalLink>\n    );\n  } else {\n    // create a regular link to external resource\n    return <a {...{ href, ...properties }}>{children}</a>;\n  }\n};\n"],"mappings":";AAqDI;AArDJ,SAAoB,KAAK,mBAAmB;AAC5C,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,yBAAyB;AAClC,SAAS,mBAAmB,sBAAsB;AAalD,MAAM,yBAAyB,CAC7B,SACA,WACA,kBAEA;AAAA,EACE,CAAC,MAA2C;AAC1C,cAAU,CAAC;AACX,QAAI,EAAE,iBAAkB;AACxB,cAAU,CAAC;AAAA,EACb;AAAA,EACA,CAAC,SAAS,GAAG,aAAa;AAC5B;AAOK,MAAM,eAAe,CAAC;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,CAAC,MAAM;AACL,UAAI,QAAQ,KAAK,WAAW,GAAG,GAAG;AAChC,UAAE,eAAe;AACjB,mBAAW,KAAK,MAAM,CAAC,CAAC;AAAA,MAC1B;AAAA,IACF;AAAA,IACA,CAAC,IAAI;AAAA,EACP;AACA,SACE,oBAAC,OAAE,MAAY,SAAS,cAAe,GAAG,OACvC,UACH;AAEJ;AAeO,MAAM,eAAe,CAAC;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,CAAC,MAAM;AACL,UAAI,CAAC,KAAM;AAEX,UAAI,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAG;AACxE,UAAI,UAAU,WAAW,QAAS;AAClC,QAAE,eAAe;AACjB,eAAS,IAAI;AAAA,IACf;AAAA,IACA,CAAC,MAAM,MAAM;AAAA,EACf;AAEA,SACE,oBAAC,OAAG,GAAG,OAAO,MAAY,QAAgB,SAAS,cAChD,UACH;AAEJ;AAIO,MAAM,OAAO,CAAC;AAAA,EACnB;AAAA,EACA;AAAA,EACA,GAAG;AACL,MAA4G;AAC1G,QAAM,EAAE,WAAW,gBAAgB,IAAI,IAAI,iBAAiB;AAE5D,MAAI,QAAQ,KAAK,WAAW,GAAG,GAAG;AAChC,WACE,oBAAC,gBAAa,MAAa,GAAG,YAC3B,UACH;AAAA,EAEJ;AACA,MAAI,QAAQ,eAAe,WAAW,MAAM,eAAe,GAAG;AAC5D,UAAM,aAAa,kBAAkB,WAAW,MAAM,eAAe;AACrE,WACE,oBAAC,gBAAa,MAAM,YAAa,GAAG,YACjC,UACH;AAAA,EAEJ,OAAO;AAEL,WAAO,oBAAC,OAAG,GAAG,EAAE,MAAM,GAAG,WAAW,GAAI,UAAS;AAAA,EACnD;AACF;","names":[]}

package/dist/components/MDXComponents.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/MDXComponents.tsx"],"sourcesContent":["import { ReactNode, use } from 'react';\nimport { Admonition } from './Admonition';\nimport { FS_PREFIX, LinkSpaceContext, normalizeAbsolute, resolveLinkTarget } from '../linkSpace';\nimport { splitHash } from '../urlUtils';\nimport { HeadingAnchor } from './HeadingAnchor';\nimport { Link } from './Link';\nimport { WikiLink } from './WikiLink';\n\n// The link primitives moved to ./Link so WikiLink can reuse Link without a\n// MDXComponents ↔ WikiLink import cycle (check:circular). Re-exported here so the\n// public `Link` / `InternalLink` entry points are unchanged.\nexport { InternalLink, Link } from './Link';\nexport { Admonition } from './Admonition';\nexport type { AdmonitionType } from './Admonition';\nexport { HeadingAnchor } from './HeadingAnchor';\nexport { WikiLink } from './WikiLink';\n\n/** Default MDX component overrides passed to {@link MDXProvider} by `boot`. These\n *  are the platform's *phantom defaults* (MARKDOWN_SYNTAX_SPEC §11.2): they are\n *  always present in the provider — even for a plain-markdown repo that never\n *  calls `boot({ mdxComponents })` — so the platform-emitted `Admonition` (§12)\n *  and `WikiLink` (§13) components resolve without the MDX missing-reference guard\n *  firing, and Markdown links route in-app via {@link Link}. An app overrides any\n *  of them by name via `boot({ mdxComponents })`, which *merges* over these\n *  defaults (§11.3) — overriding `WikiLink` alone still keeps `a` and `Admonition`. */\nexport const DEFAULT_MDX_COMPONENTS = {\n  a({\n    href,\n    children,\n    ...properties\n  }: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>) {\n    // R3-273 link spaces, same shared resolver as WikiLink: an `$fs:` href is\n    // translated to its mount-absolute path; an ABSOLUTE href is corpus-rooted\n    // when an enclosing LinkSpaceContext declares a corpusRoot (a non-corpus app\n    // declares none and is untouched). Relative and external hrefs pass through —\n    // <Link> already routes same-app hrefs and renders the rest as plain anchors.\n    const { corpusRoot } = use(LinkSpaceContext);\n    let mapped = href;\n    if (href && (href.startsWith(FS_PREFIX) || (corpusRoot !== null && href.startsWith('/')))) {\n      const [pathPart, frag] = splitHash(href);\n      const resolution = resolveLinkTarget(pathPart, { corpusRoot });\n      if (resolution.state !== 'resolved') {\n        // Malformed `$fs:` (incl. scheme smuggling) — broken text, never an anchor.\n        return (\n          <span className=\"ir-link-broken\" data-state=\"broken\" title={`Invalid ${FS_PREFIX} link: ${href}`}>\n            {children}\n          </span>\n        );\n      }\n      mapped = `${resolution.path}${frag ? `#${frag}` : ''}`;\n    }\n    return (\n      <Link href={mapped} {...properties}>\n        {children}\n      </Link>\n    );\n  },\n  Admonition,\n  HeadingAnchor,\n  WikiLink,\n} as Record<string, (props: any) => ReactNode>;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4CU;AA5CV,mBAA+B;AAC/B,wBAA2B;AAC3B,uBAAkF;AAClF,sBAA0B;AAC1B,2BAA8B;AAC9B,kBAAqB;AACrB,sBAAyB;AAKzB,IAAAA,eAAmC;AACnC,IAAAC,qBAA2B;AAE3B,IAAAC,wBAA8B;AAC9B,IAAAC,mBAAyB;AAUlB,MAAM,yBAAyB;AAAA,EACpC,EAAE;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL,GAA8F;AAM5F,UAAM,EAAE,WAAW,QAAI,kBAAI,iCAAgB;AAC3C,QAAI,SAAS;AACb,QAAI,SAAS,KAAK,WAAW,0BAAS,KAAM,eAAe,QAAQ,KAAK,WAAW,GAAG,IAAK;AACzF,YAAM,CAAC,UAAU,IAAI,QAAI,2BAAU,IAAI;AACvC,YAAM,iBAAa,oCAAkB,UAAU,EAAE,WAAW,CAAC;AAC7D,UAAI,WAAW,UAAU,YAAY;AAEnC,eACE,4CAAC,UAAK,WAAU,kBAAiB,cAAW,UAAS,OAAO,WAAW,0BAAS,UAAU,IAAI,IAC3F,UACH;AAAA,MAEJ;AACA,eAAS,GAAG,WAAW,IAAI,GAAG,OAAO,IAAI,IAAI,KAAK,EAAE;AAAA,IACtD;AACA,WACE,4CAAC,oBAAK,MAAM,QAAS,GAAG,YACrB,UACH;AAAA,EAEJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;","names":["import_Link","import_Admonition","import_HeadingAnchor","import_WikiLink"]}
+{"version":3,"sources":["../../src/components/MDXComponents.tsx"],"sourcesContent":["import { ReactNode, use } from 'react';\nimport { Admonition } from './Admonition';\nimport { FS_PREFIX, LinkSpaceContext, resolveLinkTarget } from '../linkSpace';\nimport { splitHash } from '../urlUtils';\nimport { HeadingAnchor } from './HeadingAnchor';\nimport { Link } from './Link';\nimport { WikiLink } from './WikiLink';\n\n// The link primitives moved to ./Link so WikiLink can reuse Link without a\n// MDXComponents ↔ WikiLink import cycle (check:circular). Re-exported here so the\n// public `Link` / `InternalLink` entry points are unchanged.\nexport { InternalLink, Link } from './Link';\nexport { Admonition } from './Admonition';\nexport type { AdmonitionType } from './Admonition';\nexport { HeadingAnchor } from './HeadingAnchor';\nexport { WikiLink } from './WikiLink';\n\n/** Default MDX component overrides passed to {@link MDXProvider} by `boot`. These\n *  are the platform's *phantom defaults* (MARKDOWN_SYNTAX_SPEC §11.2): they are\n *  always present in the provider — even for a plain-markdown repo that never\n *  calls `boot({ mdxComponents })` — so the platform-emitted `Admonition` (§12)\n *  and `WikiLink` (§13) components resolve without the MDX missing-reference guard\n *  firing, and Markdown links route in-app via {@link Link}. An app overrides any\n *  of them by name via `boot({ mdxComponents })`, which *merges* over these\n *  defaults (§11.3) — overriding `WikiLink` alone still keeps `a` and `Admonition`. */\nexport const DEFAULT_MDX_COMPONENTS = {\n  a({\n    href,\n    children,\n    ...properties\n  }: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>) {\n    // R3-273 link spaces, same shared resolver as WikiLink: an `$fs:` href is\n    // translated to its mount-absolute path; an ABSOLUTE href is corpus-rooted\n    // when an enclosing LinkSpaceContext declares a corpusRoot (a non-corpus app\n    // declares none and is untouched). Relative and external hrefs pass through —\n    // <Link> already routes same-app hrefs and renders the rest as plain anchors.\n    const { corpusRoot } = use(LinkSpaceContext);\n    let mapped = href;\n    if (href && (href.startsWith(FS_PREFIX) || (corpusRoot !== null && href.startsWith('/')))) {\n      const [pathPart, frag] = splitHash(href);\n      const resolution = resolveLinkTarget(pathPart, { corpusRoot });\n      if (resolution.state !== 'resolved') {\n        // Malformed `$fs:` (incl. scheme smuggling) — broken text, never an anchor.\n        return (\n          <span className=\"ir-link-broken\" data-state=\"broken\" title={`Invalid ${FS_PREFIX} link: ${href}`}>\n            {children}\n          </span>\n        );\n      }\n      mapped = `${resolution.path}${frag ? `#${frag}` : ''}`;\n    }\n    return (\n      <Link href={mapped} {...properties}>\n        {children}\n      </Link>\n    );\n  },\n  Admonition,\n  HeadingAnchor,\n  WikiLink,\n} as Record<string, (props: any) => ReactNode>;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4CU;AA5CV,mBAA+B;AAC/B,wBAA2B;AAC3B,uBAA+D;AAC/D,sBAA0B;AAC1B,2BAA8B;AAC9B,kBAAqB;AACrB,sBAAyB;AAKzB,IAAAA,eAAmC;AACnC,IAAAC,qBAA2B;AAE3B,IAAAC,wBAA8B;AAC9B,IAAAC,mBAAyB;AAUlB,MAAM,yBAAyB;AAAA,EACpC,EAAE;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL,GAA8F;AAM5F,UAAM,EAAE,WAAW,QAAI,kBAAI,iCAAgB;AAC3C,QAAI,SAAS;AACb,QAAI,SAAS,KAAK,WAAW,0BAAS,KAAM,eAAe,QAAQ,KAAK,WAAW,GAAG,IAAK;AACzF,YAAM,CAAC,UAAU,IAAI,QAAI,2BAAU,IAAI;AACvC,YAAM,iBAAa,oCAAkB,UAAU,EAAE,WAAW,CAAC;AAC7D,UAAI,WAAW,UAAU,YAAY;AAEnC,eACE,4CAAC,UAAK,WAAU,kBAAiB,cAAW,UAAS,OAAO,WAAW,0BAAS,UAAU,IAAI,IAC3F,UACH;AAAA,MAEJ;AACA,eAAS,GAAG,WAAW,IAAI,GAAG,OAAO,IAAI,IAAI,KAAK,EAAE;AAAA,IACtD;AACA,WACE,4CAAC,oBAAK,MAAM,QAAS,GAAG,YACrB,UACH;AAAA,EAEJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;","names":["import_Link","import_Admonition","import_HeadingAnchor","import_WikiLink"]}

package/dist/components/MDXComponents.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/MDXComponents.tsx"],"sourcesContent":["import { ReactNode, use } from 'react';\nimport { Admonition } from './Admonition';\nimport { FS_PREFIX, LinkSpaceContext, normalizeAbsolute, resolveLinkTarget } from '../linkSpace';\nimport { splitHash } from '../urlUtils';\nimport { HeadingAnchor } from './HeadingAnchor';\nimport { Link } from './Link';\nimport { WikiLink } from './WikiLink';\n\n// The link primitives moved to ./Link so WikiLink can reuse Link without a\n// MDXComponents ↔ WikiLink import cycle (check:circular). Re-exported here so the\n// public `Link` / `InternalLink` entry points are unchanged.\nexport { InternalLink, Link } from './Link';\nexport { Admonition } from './Admonition';\nexport type { AdmonitionType } from './Admonition';\nexport { HeadingAnchor } from './HeadingAnchor';\nexport { WikiLink } from './WikiLink';\n\n/** Default MDX component overrides passed to {@link MDXProvider} by `boot`. These\n *  are the platform's *phantom defaults* (MARKDOWN_SYNTAX_SPEC §11.2): they are\n *  always present in the provider — even for a plain-markdown repo that never\n *  calls `boot({ mdxComponents })` — so the platform-emitted `Admonition` (§12)\n *  and `WikiLink` (§13) components resolve without the MDX missing-reference guard\n *  firing, and Markdown links route in-app via {@link Link}. An app overrides any\n *  of them by name via `boot({ mdxComponents })`, which *merges* over these\n *  defaults (§11.3) — overriding `WikiLink` alone still keeps `a` and `Admonition`. */\nexport const DEFAULT_MDX_COMPONENTS = {\n  a({\n    href,\n    children,\n    ...properties\n  }: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>) {\n    // R3-273 link spaces, same shared resolver as WikiLink: an `$fs:` href is\n    // translated to its mount-absolute path; an ABSOLUTE href is corpus-rooted\n    // when an enclosing LinkSpaceContext declares a corpusRoot (a non-corpus app\n    // declares none and is untouched). Relative and external hrefs pass through —\n    // <Link> already routes same-app hrefs and renders the rest as plain anchors.\n    const { corpusRoot } = use(LinkSpaceContext);\n    let mapped = href;\n    if (href && (href.startsWith(FS_PREFIX) || (corpusRoot !== null && href.startsWith('/')))) {\n      const [pathPart, frag] = splitHash(href);\n      const resolution = resolveLinkTarget(pathPart, { corpusRoot });\n      if (resolution.state !== 'resolved') {\n        // Malformed `$fs:` (incl. scheme smuggling) — broken text, never an anchor.\n        return (\n          <span className=\"ir-link-broken\" data-state=\"broken\" title={`Invalid ${FS_PREFIX} link: ${href}`}>\n            {children}\n          </span>\n        );\n      }\n      mapped = `${resolution.path}${frag ? `#${frag}` : ''}`;\n    }\n    return (\n      <Link href={mapped} {...properties}>\n        {children}\n      </Link>\n    );\n  },\n  Admonition,\n  HeadingAnchor,\n  WikiLink,\n} as Record<string, (props: any) => ReactNode>;\n"],"mappings":";AA4CU;AA5CV,SAAoB,WAAW;AAC/B,SAAS,kBAAkB;AAC3B,SAAS,WAAW,kBAAqC,yBAAyB;AAClF,SAAS,iBAAiB;AAC1B,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AACrB,SAAS,gBAAgB;AAKzB,SAAS,cAAc,QAAAA,aAAY;AACnC,SAAS,cAAAC,mBAAkB;AAE3B,SAAS,iBAAAC,sBAAqB;AAC9B,SAAS,YAAAC,iBAAgB;AAUlB,MAAM,yBAAyB;AAAA,EACpC,EAAE;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL,GAA8F;AAM5F,UAAM,EAAE,WAAW,IAAI,IAAI,gBAAgB;AAC3C,QAAI,SAAS;AACb,QAAI,SAAS,KAAK,WAAW,SAAS,KAAM,eAAe,QAAQ,KAAK,WAAW,GAAG,IAAK;AACzF,YAAM,CAAC,UAAU,IAAI,IAAI,UAAU,IAAI;AACvC,YAAM,aAAa,kBAAkB,UAAU,EAAE,WAAW,CAAC;AAC7D,UAAI,WAAW,UAAU,YAAY;AAEnC,eACE,oBAAC,UAAK,WAAU,kBAAiB,cAAW,UAAS,OAAO,WAAW,SAAS,UAAU,IAAI,IAC3F,UACH;AAAA,MAEJ;AACA,eAAS,GAAG,WAAW,IAAI,GAAG,OAAO,IAAI,IAAI,KAAK,EAAE;AAAA,IACtD;AACA,WACE,oBAAC,QAAK,MAAM,QAAS,GAAG,YACrB,UACH;AAAA,EAEJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;","names":["Link","Admonition","HeadingAnchor","WikiLink"]}
+{"version":3,"sources":["../../src/components/MDXComponents.tsx"],"sourcesContent":["import { ReactNode, use } from 'react';\nimport { Admonition } from './Admonition';\nimport { FS_PREFIX, LinkSpaceContext, resolveLinkTarget } from '../linkSpace';\nimport { splitHash } from '../urlUtils';\nimport { HeadingAnchor } from './HeadingAnchor';\nimport { Link } from './Link';\nimport { WikiLink } from './WikiLink';\n\n// The link primitives moved to ./Link so WikiLink can reuse Link without a\n// MDXComponents ↔ WikiLink import cycle (check:circular). Re-exported here so the\n// public `Link` / `InternalLink` entry points are unchanged.\nexport { InternalLink, Link } from './Link';\nexport { Admonition } from './Admonition';\nexport type { AdmonitionType } from './Admonition';\nexport { HeadingAnchor } from './HeadingAnchor';\nexport { WikiLink } from './WikiLink';\n\n/** Default MDX component overrides passed to {@link MDXProvider} by `boot`. These\n *  are the platform's *phantom defaults* (MARKDOWN_SYNTAX_SPEC §11.2): they are\n *  always present in the provider — even for a plain-markdown repo that never\n *  calls `boot({ mdxComponents })` — so the platform-emitted `Admonition` (§12)\n *  and `WikiLink` (§13) components resolve without the MDX missing-reference guard\n *  firing, and Markdown links route in-app via {@link Link}. An app overrides any\n *  of them by name via `boot({ mdxComponents })`, which *merges* over these\n *  defaults (§11.3) — overriding `WikiLink` alone still keeps `a` and `Admonition`. */\nexport const DEFAULT_MDX_COMPONENTS = {\n  a({\n    href,\n    children,\n    ...properties\n  }: React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>) {\n    // R3-273 link spaces, same shared resolver as WikiLink: an `$fs:` href is\n    // translated to its mount-absolute path; an ABSOLUTE href is corpus-rooted\n    // when an enclosing LinkSpaceContext declares a corpusRoot (a non-corpus app\n    // declares none and is untouched). Relative and external hrefs pass through —\n    // <Link> already routes same-app hrefs and renders the rest as plain anchors.\n    const { corpusRoot } = use(LinkSpaceContext);\n    let mapped = href;\n    if (href && (href.startsWith(FS_PREFIX) || (corpusRoot !== null && href.startsWith('/')))) {\n      const [pathPart, frag] = splitHash(href);\n      const resolution = resolveLinkTarget(pathPart, { corpusRoot });\n      if (resolution.state !== 'resolved') {\n        // Malformed `$fs:` (incl. scheme smuggling) — broken text, never an anchor.\n        return (\n          <span className=\"ir-link-broken\" data-state=\"broken\" title={`Invalid ${FS_PREFIX} link: ${href}`}>\n            {children}\n          </span>\n        );\n      }\n      mapped = `${resolution.path}${frag ? `#${frag}` : ''}`;\n    }\n    return (\n      <Link href={mapped} {...properties}>\n        {children}\n      </Link>\n    );\n  },\n  Admonition,\n  HeadingAnchor,\n  WikiLink,\n} as Record<string, (props: any) => ReactNode>;\n"],"mappings":";AA4CU;AA5CV,SAAoB,WAAW;AAC/B,SAAS,kBAAkB;AAC3B,SAAS,WAAW,kBAAkB,yBAAyB;AAC/D,SAAS,iBAAiB;AAC1B,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AACrB,SAAS,gBAAgB;AAKzB,SAAS,cAAc,QAAAA,aAAY;AACnC,SAAS,cAAAC,mBAAkB;AAE3B,SAAS,iBAAAC,sBAAqB;AAC9B,SAAS,YAAAC,iBAAgB;AAUlB,MAAM,yBAAyB;AAAA,EACpC,EAAE;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL,GAA8F;AAM5F,UAAM,EAAE,WAAW,IAAI,IAAI,gBAAgB;AAC3C,QAAI,SAAS;AACb,QAAI,SAAS,KAAK,WAAW,SAAS,KAAM,eAAe,QAAQ,KAAK,WAAW,GAAG,IAAK;AACzF,YAAM,CAAC,UAAU,IAAI,IAAI,UAAU,IAAI;AACvC,YAAM,aAAa,kBAAkB,UAAU,EAAE,WAAW,CAAC;AAC7D,UAAI,WAAW,UAAU,YAAY;AAEnC,eACE,oBAAC,UAAK,WAAU,kBAAiB,cAAW,UAAS,OAAO,WAAW,SAAS,UAAU,IAAI,IAC3F,UACH;AAAA,MAEJ;AACA,eAAS,GAAG,WAAW,IAAI,GAAG,OAAO,IAAI,IAAI,KAAK,EAAE;AAAA,IACtD;AACA,WACE,oBAAC,QAAK,MAAM,QAAS,GAAG,YACrB,UACH;AAAA,EAEJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;","names":["Link","Admonition","HeadingAnchor","WikiLink"]}

package/dist/components/ScrollAfterNavigation.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/ScrollAfterNavigation.tsx"],"sourcesContent":["import { use, useEffect } from 'react';\n\nimport { TinkerableContext } from '../TinkerableContext';\nimport { scrollToId } from '../scrollToId';\n\n/**\n * Deep-linking Capability C (MARKDOWN_SYNTAX_SPEC §13.5): after an in-app navigation\n * whose URL carries a `#fragment`, scroll the target section into view.\n *\n * In-app navigation swaps the rendered file **asynchronously** — the destination\n * file's tree mounts *after* the route change — so the element the fragment\n * addresses does not exist at click time. This effect records the pending fragment\n * and retries until the target appears: an immediate attempt, a `MutationObserver`\n * over late-mounting subtrees, and a few timed retries (the `[120, 300, 600]ms`\n * cadence `grove/src/components/Toc.tsx` proves for late-mounting prose). If the\n * target never appears within the window it degrades to top-of-page — a missing\n * fragment is never a hard failure.\n *\n * It re-runs when the destination page **or** the fragment changes, so a fresh click\n * on the same target re-scrolls. Mounted once inside the navigation provider (see\n * `boot`'s `TinkerableApp`) so it is uniform for **every** MDX app — the SDK router\n * owns cross-page anchor navigation, not any one consumer (Grove).\n */\nexport const useScrollAfterNavigation = (): void => {\n  const { navigationState } = use(TinkerableContext);\n  const frag = navigationState.hash;\n  // Re-run when the destination page OR the fragment changes.\n  const navKey = `${navigationState.sandboxPath}\u0000${frag}`;\n\n  useEffect(() => {\n    if (!frag || typeof document === 'undefined') return;\n    // Fast path: the target is already in the DOM (same page, or the tree mounted\n    // synchronously) — scroll now, no observer/timer churn.\n    if (scrollToId(frag)) return;\n\n    let done = false;\n    const finish = () => {\n      done = true;\n      observer.disconnect();\n      timers.forEach(clearTimeout);\n      clearTimeout(finalTimer);\n    };\n    const tryScroll = () => {\n      if (!done && scrollToId(frag)) finish();\n    };\n\n    const observer = new MutationObserver(tryScroll);\n    const timers = [120, 300, 600].map((ms) => setTimeout(tryScroll, ms));\n    // Final fallback once the retry window closes: if the fragment never resolved,\n    // scroll to the top rather than strand the reader at the previous page's offset.\n    const finalTimer = setTimeout(() => {\n      if (!done) {\n        finish();\n        window.scrollTo?.(0, 0);\n      }\n    }, 900);\n\n    observer.observe(document.body, { childList: true, subtree: true });\n    return finish;\n  }, [navKey, frag]);\n};\n\n/** Null-rendering mount point for {@link useScrollAfterNavigation} inside the\n *  navigation provider. */\nexport const ScrollAfterNavigation = (): null => {\n  useScrollAfterNavigation();\n  return null;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA+B;AAE/B,+BAAkC;AAClC,wBAA2B;AAoBpB,MAAM,2BAA2B,MAAY;AAClD,QAAM,EAAE,gBAAgB,QAAI,kBAAI,0CAAiB;AACjD,QAAM,OAAO,gBAAgB;AAE7B,QAAM,SAAS,GAAG,gBAAgB,WAAW,KAAI,IAAI;AAErD,8BAAU,MAAM;AACd,QAAI,CAAC,QAAQ,OAAO,aAAa,YAAa;AAG9C,YAAI,8BAAW,IAAI,EAAG;AAEtB,QAAI,OAAO;AACX,UAAM,SAAS,MAAM;AACnB,aAAO;AACP,eAAS,WAAW;AACpB,aAAO,QAAQ,YAAY;AAC3B,mBAAa,UAAU;AAAA,IACzB;AACA,UAAM,YAAY,MAAM;AACtB,UAAI,CAAC,YAAQ,8BAAW,IAAI,EAAG,QAAO;AAAA,IACxC;AAEA,UAAM,WAAW,IAAI,iBAAiB,SAAS;AAC/C,UAAM,SAAS,CAAC,KAAK,KAAK,GAAG,EAAE,IAAI,CAAC,OAAO,WAAW,WAAW,EAAE,CAAC;AAGpE,UAAM,aAAa,WAAW,MAAM;AAClC,UAAI,CAAC,MAAM;AACT,eAAO;AACP,eAAO,WAAW,GAAG,CAAC;AAAA,MACxB;AAAA,IACF,GAAG,GAAG;AAEN,aAAS,QAAQ,SAAS,MAAM,EAAE,WAAW,MAAM,SAAS,KAAK,CAAC;AAClE,WAAO;AAAA,EACT,GAAG,CAAC,QAAQ,IAAI,CAAC;AACnB;AAIO,MAAM,wBAAwB,MAAY;AAC/C,2BAAyB;AACzB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/components/ScrollAfterNavigation.tsx"],"sourcesContent":["import { use, useEffect } from 'react';\n\nimport { TinkerableContext } from '../TinkerableContext';\nimport { scrollToId } from '../scrollToId';\n\n/**\n * Deep-linking Capability C (MARKDOWN_SYNTAX_SPEC §13.5): after an in-app navigation\n * whose URL carries a `#fragment`, scroll the target section into view.\n *\n * In-app navigation swaps the rendered file **asynchronously** — the destination\n * file's tree mounts *after* the route change — so the element the fragment\n * addresses does not exist at click time. This effect records the pending fragment\n * and retries until the target appears: an immediate attempt, a `MutationObserver`\n * over late-mounting subtrees, and a few timed retries (the `[120, 300, 600]ms`\n * cadence `grove/src/components/Toc.tsx` proves for late-mounting prose). If the\n * target never appears within the window it degrades to top-of-page — a missing\n * fragment is never a hard failure.\n *\n * It re-runs when the destination page **or** the fragment changes, so a fresh click\n * on the same target re-scrolls. Mounted once inside the navigation provider (see\n * `boot`'s `TinkerableApp`) so it is uniform for **every** MDX app — the SDK router\n * owns cross-page anchor navigation, not any one consumer (Grove).\n */\nexport const useScrollAfterNavigation = (): void => {\n  const { navigationState } = use(TinkerableContext);\n  const frag = navigationState.hash;\n  // Re-run when the destination page OR the fragment changes. The two are joined\n  // with a NUL — a byte neither a sandbox path nor a fragment can contain — so no\n  // pair of (path, fragment) values can collide into the same key. It is written as\n  // the \\u0000 ESCAPE, never as a raw byte: a literal NUL in the source makes the\n  // file binary to grep, diff and review tooling.\n  const navKey = `${navigationState.sandboxPath}\\u0000${frag}`;\n\n  useEffect(() => {\n    if (!frag || typeof document === 'undefined') return;\n    // Fast path: the target is already in the DOM (same page, or the tree mounted\n    // synchronously) — scroll now, no observer/timer churn.\n    if (scrollToId(frag)) return;\n\n    let done = false;\n    const finish = () => {\n      done = true;\n      observer.disconnect();\n      timers.forEach(clearTimeout);\n      clearTimeout(finalTimer);\n    };\n    const tryScroll = () => {\n      if (!done && scrollToId(frag)) finish();\n    };\n\n    const observer = new MutationObserver(tryScroll);\n    const timers = [120, 300, 600].map((ms) => setTimeout(tryScroll, ms));\n    // Final fallback once the retry window closes: if the fragment never resolved,\n    // scroll to the top rather than strand the reader at the previous page's offset.\n    const finalTimer = setTimeout(() => {\n      if (!done) {\n        finish();\n        window.scrollTo?.(0, 0);\n      }\n    }, 900);\n\n    observer.observe(document.body, { childList: true, subtree: true });\n    return finish;\n  }, [navKey, frag]);\n};\n\n/** Null-rendering mount point for {@link useScrollAfterNavigation} inside the\n *  navigation provider. */\nexport const ScrollAfterNavigation = (): null => {\n  useScrollAfterNavigation();\n  return null;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA+B;AAE/B,+BAAkC;AAClC,wBAA2B;AAoBpB,MAAM,2BAA2B,MAAY;AAClD,QAAM,EAAE,gBAAgB,QAAI,kBAAI,0CAAiB;AACjD,QAAM,OAAO,gBAAgB;AAM7B,QAAM,SAAS,GAAG,gBAAgB,WAAW,KAAS,IAAI;AAE1D,8BAAU,MAAM;AACd,QAAI,CAAC,QAAQ,OAAO,aAAa,YAAa;AAG9C,YAAI,8BAAW,IAAI,EAAG;AAEtB,QAAI,OAAO;AACX,UAAM,SAAS,MAAM;AACnB,aAAO;AACP,eAAS,WAAW;AACpB,aAAO,QAAQ,YAAY;AAC3B,mBAAa,UAAU;AAAA,IACzB;AACA,UAAM,YAAY,MAAM;AACtB,UAAI,CAAC,YAAQ,8BAAW,IAAI,EAAG,QAAO;AAAA,IACxC;AAEA,UAAM,WAAW,IAAI,iBAAiB,SAAS;AAC/C,UAAM,SAAS,CAAC,KAAK,KAAK,GAAG,EAAE,IAAI,CAAC,OAAO,WAAW,WAAW,EAAE,CAAC;AAGpE,UAAM,aAAa,WAAW,MAAM;AAClC,UAAI,CAAC,MAAM;AACT,eAAO;AACP,eAAO,WAAW,GAAG,CAAC;AAAA,MACxB;AAAA,IACF,GAAG,GAAG;AAEN,aAAS,QAAQ,SAAS,MAAM,EAAE,WAAW,MAAM,SAAS,KAAK,CAAC;AAClE,WAAO;AAAA,EACT,GAAG,CAAC,QAAQ,IAAI,CAAC;AACnB;AAIO,MAAM,wBAAwB,MAAY;AAC/C,2BAAyB;AACzB,SAAO;AACT;","names":[]}

package/dist/components/ScrollAfterNavigation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/ScrollAfterNavigation.tsx"],"sourcesContent":["import { use, useEffect } from 'react';\n\nimport { TinkerableContext } from '../TinkerableContext';\nimport { scrollToId } from '../scrollToId';\n\n/**\n * Deep-linking Capability C (MARKDOWN_SYNTAX_SPEC §13.5): after an in-app navigation\n * whose URL carries a `#fragment`, scroll the target section into view.\n *\n * In-app navigation swaps the rendered file **asynchronously** — the destination\n * file's tree mounts *after* the route change — so the element the fragment\n * addresses does not exist at click time. This effect records the pending fragment\n * and retries until the target appears: an immediate attempt, a `MutationObserver`\n * over late-mounting subtrees, and a few timed retries (the `[120, 300, 600]ms`\n * cadence `grove/src/components/Toc.tsx` proves for late-mounting prose). If the\n * target never appears within the window it degrades to top-of-page — a missing\n * fragment is never a hard failure.\n *\n * It re-runs when the destination page **or** the fragment changes, so a fresh click\n * on the same target re-scrolls. Mounted once inside the navigation provider (see\n * `boot`'s `TinkerableApp`) so it is uniform for **every** MDX app — the SDK router\n * owns cross-page anchor navigation, not any one consumer (Grove).\n */\nexport const useScrollAfterNavigation = (): void => {\n  const { navigationState } = use(TinkerableContext);\n  const frag = navigationState.hash;\n  // Re-run when the destination page OR the fragment changes.\n  const navKey = `${navigationState.sandboxPath}\u0000${frag}`;\n\n  useEffect(() => {\n    if (!frag || typeof document === 'undefined') return;\n    // Fast path: the target is already in the DOM (same page, or the tree mounted\n    // synchronously) — scroll now, no observer/timer churn.\n    if (scrollToId(frag)) return;\n\n    let done = false;\n    const finish = () => {\n      done = true;\n      observer.disconnect();\n      timers.forEach(clearTimeout);\n      clearTimeout(finalTimer);\n    };\n    const tryScroll = () => {\n      if (!done && scrollToId(frag)) finish();\n    };\n\n    const observer = new MutationObserver(tryScroll);\n    const timers = [120, 300, 600].map((ms) => setTimeout(tryScroll, ms));\n    // Final fallback once the retry window closes: if the fragment never resolved,\n    // scroll to the top rather than strand the reader at the previous page's offset.\n    const finalTimer = setTimeout(() => {\n      if (!done) {\n        finish();\n        window.scrollTo?.(0, 0);\n      }\n    }, 900);\n\n    observer.observe(document.body, { childList: true, subtree: true });\n    return finish;\n  }, [navKey, frag]);\n};\n\n/** Null-rendering mount point for {@link useScrollAfterNavigation} inside the\n *  navigation provider. */\nexport const ScrollAfterNavigation = (): null => {\n  useScrollAfterNavigation();\n  return null;\n};\n"],"mappings":";AAAA,SAAS,KAAK,iBAAiB;AAE/B,SAAS,yBAAyB;AAClC,SAAS,kBAAkB;AAoBpB,MAAM,2BAA2B,MAAY;AAClD,QAAM,EAAE,gBAAgB,IAAI,IAAI,iBAAiB;AACjD,QAAM,OAAO,gBAAgB;AAE7B,QAAM,SAAS,GAAG,gBAAgB,WAAW,KAAI,IAAI;AAErD,YAAU,MAAM;AACd,QAAI,CAAC,QAAQ,OAAO,aAAa,YAAa;AAG9C,QAAI,WAAW,IAAI,EAAG;AAEtB,QAAI,OAAO;AACX,UAAM,SAAS,MAAM;AACnB,aAAO;AACP,eAAS,WAAW;AACpB,aAAO,QAAQ,YAAY;AAC3B,mBAAa,UAAU;AAAA,IACzB;AACA,UAAM,YAAY,MAAM;AACtB,UAAI,CAAC,QAAQ,WAAW,IAAI,EAAG,QAAO;AAAA,IACxC;AAEA,UAAM,WAAW,IAAI,iBAAiB,SAAS;AAC/C,UAAM,SAAS,CAAC,KAAK,KAAK,GAAG,EAAE,IAAI,CAAC,OAAO,WAAW,WAAW,EAAE,CAAC;AAGpE,UAAM,aAAa,WAAW,MAAM;AAClC,UAAI,CAAC,MAAM;AACT,eAAO;AACP,eAAO,WAAW,GAAG,CAAC;AAAA,MACxB;AAAA,IACF,GAAG,GAAG;AAEN,aAAS,QAAQ,SAAS,MAAM,EAAE,WAAW,MAAM,SAAS,KAAK,CAAC;AAClE,WAAO;AAAA,EACT,GAAG,CAAC,QAAQ,IAAI,CAAC;AACnB;AAIO,MAAM,wBAAwB,MAAY;AAC/C,2BAAyB;AACzB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/components/ScrollAfterNavigation.tsx"],"sourcesContent":["import { use, useEffect } from 'react';\n\nimport { TinkerableContext } from '../TinkerableContext';\nimport { scrollToId } from '../scrollToId';\n\n/**\n * Deep-linking Capability C (MARKDOWN_SYNTAX_SPEC §13.5): after an in-app navigation\n * whose URL carries a `#fragment`, scroll the target section into view.\n *\n * In-app navigation swaps the rendered file **asynchronously** — the destination\n * file's tree mounts *after* the route change — so the element the fragment\n * addresses does not exist at click time. This effect records the pending fragment\n * and retries until the target appears: an immediate attempt, a `MutationObserver`\n * over late-mounting subtrees, and a few timed retries (the `[120, 300, 600]ms`\n * cadence `grove/src/components/Toc.tsx` proves for late-mounting prose). If the\n * target never appears within the window it degrades to top-of-page — a missing\n * fragment is never a hard failure.\n *\n * It re-runs when the destination page **or** the fragment changes, so a fresh click\n * on the same target re-scrolls. Mounted once inside the navigation provider (see\n * `boot`'s `TinkerableApp`) so it is uniform for **every** MDX app — the SDK router\n * owns cross-page anchor navigation, not any one consumer (Grove).\n */\nexport const useScrollAfterNavigation = (): void => {\n  const { navigationState } = use(TinkerableContext);\n  const frag = navigationState.hash;\n  // Re-run when the destination page OR the fragment changes. The two are joined\n  // with a NUL — a byte neither a sandbox path nor a fragment can contain — so no\n  // pair of (path, fragment) values can collide into the same key. It is written as\n  // the \\u0000 ESCAPE, never as a raw byte: a literal NUL in the source makes the\n  // file binary to grep, diff and review tooling.\n  const navKey = `${navigationState.sandboxPath}\\u0000${frag}`;\n\n  useEffect(() => {\n    if (!frag || typeof document === 'undefined') return;\n    // Fast path: the target is already in the DOM (same page, or the tree mounted\n    // synchronously) — scroll now, no observer/timer churn.\n    if (scrollToId(frag)) return;\n\n    let done = false;\n    const finish = () => {\n      done = true;\n      observer.disconnect();\n      timers.forEach(clearTimeout);\n      clearTimeout(finalTimer);\n    };\n    const tryScroll = () => {\n      if (!done && scrollToId(frag)) finish();\n    };\n\n    const observer = new MutationObserver(tryScroll);\n    const timers = [120, 300, 600].map((ms) => setTimeout(tryScroll, ms));\n    // Final fallback once the retry window closes: if the fragment never resolved,\n    // scroll to the top rather than strand the reader at the previous page's offset.\n    const finalTimer = setTimeout(() => {\n      if (!done) {\n        finish();\n        window.scrollTo?.(0, 0);\n      }\n    }, 900);\n\n    observer.observe(document.body, { childList: true, subtree: true });\n    return finish;\n  }, [navKey, frag]);\n};\n\n/** Null-rendering mount point for {@link useScrollAfterNavigation} inside the\n *  navigation provider. */\nexport const ScrollAfterNavigation = (): null => {\n  useScrollAfterNavigation();\n  return null;\n};\n"],"mappings":";AAAA,SAAS,KAAK,iBAAiB;AAE/B,SAAS,yBAAyB;AAClC,SAAS,kBAAkB;AAoBpB,MAAM,2BAA2B,MAAY;AAClD,QAAM,EAAE,gBAAgB,IAAI,IAAI,iBAAiB;AACjD,QAAM,OAAO,gBAAgB;AAM7B,QAAM,SAAS,GAAG,gBAAgB,WAAW,KAAS,IAAI;AAE1D,YAAU,MAAM;AACd,QAAI,CAAC,QAAQ,OAAO,aAAa,YAAa;AAG9C,QAAI,WAAW,IAAI,EAAG;AAEtB,QAAI,OAAO;AACX,UAAM,SAAS,MAAM;AACnB,aAAO;AACP,eAAS,WAAW;AACpB,aAAO,QAAQ,YAAY;AAC3B,mBAAa,UAAU;AAAA,IACzB;AACA,UAAM,YAAY,MAAM;AACtB,UAAI,CAAC,QAAQ,WAAW,IAAI,EAAG,QAAO;AAAA,IACxC;AAEA,UAAM,WAAW,IAAI,iBAAiB,SAAS;AAC/C,UAAM,SAAS,CAAC,KAAK,KAAK,GAAG,EAAE,IAAI,CAAC,OAAO,WAAW,WAAW,EAAE,CAAC;AAGpE,UAAM,aAAa,WAAW,MAAM;AAClC,UAAI,CAAC,MAAM;AACT,eAAO;AACP,eAAO,WAAW,GAAG,CAAC;AAAA,MACxB;AAAA,IACF,GAAG,GAAG;AAEN,aAAS,QAAQ,SAAS,MAAM,EAAE,WAAW,MAAM,SAAS,KAAK,CAAC;AAClE,WAAO;AAAA,EACT,GAAG,CAAC,QAAQ,IAAI,CAAC;AACnB;AAIO,MAAM,wBAAwB,MAAY;AAC/C,2BAAyB;AACzB,SAAO;AACT;","names":[]}

package/dist/markers.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/markers.ts"],"sourcesContent":["// Runtime emission of the boot `ir.*` markers (LOAD_PROFILING_SPEC §3/§3.2, R3-46).\n//\n// The host already MERGED the receive end: it validates a forwarded\n// `{ type:'ir-marker', name, at, attrs? }` against the LP-5 allowlist\n// (`irMarkers.ts`) and brackets request→interactive, treating an accepted\n// `ir.interactive` as the root-render-commit signal (site-main\n// `routePerfMessage`/`perfTimeline`). This module is the SANDBOX-side emitter for\n// the boot marks the SDK owns — `ir.fmp` (first meaningful paint) and\n// `ir.interactive` (root render commit) — forwarded over the same transport as\n// `reportReady()` (`ready.ts`). The per-marker timestamp is the sandbox-relative\n// `performance.now()` at emission (§3.2).\n//\n// Mirrors `ready.ts`'s dependency seam so the emission is unit-testable without a\n// host transport, and is idempotent per name so React StrictMode's double-invoke\n// (or any re-commit) can't mint a boot mark twice.\nimport { sendMessage as defaultSend } from './sandboxUtils';\nimport { isIrMarkerName, type IrMarkerName } from './irMarkers';\n\ninterface MarkerDeps {\n  send: (type: string, data?: Record<string, unknown>) => void;\n  now: () => number;\n}\n\nconst realNow = (): number =>\n  typeof performance !== 'undefined' && typeof performance.now === 'function' ? performance.now() : Date.now();\n\nconst defaultDeps: MarkerDeps = { send: defaultSend, now: realNow };\n\nlet deps: MarkerDeps = defaultDeps;\nconst emitted = new Set<string>();\n\n/**\n * Forward one `ir.*` marker to the host (`ir-marker`). The host re-validates against\n * the allowlist, so a bad name/attr is dropped there; we only emit names the SDK\n * itself owns. A transport that isn't ready yet is swallowed — a missing boot mark\n * must never break the app's boot.\n */\nexport function emitMarker(name: IrMarkerName, attrs?: Record<string, unknown>): void {\n  if (!isIrMarkerName(name)) return;\n  try {\n    deps.send('ir-marker', { name, at: deps.now(), ...(attrs !== undefined ? { attrs } : {}) });\n  } catch {\n    /* transport not ready — boot continues; the host simply lacks this mark */\n  }\n}\n\n/** Emit a boot one-shot at most once per name (idempotent across StrictMode/re-commit). */\nexport function emitMarkerOnce(name: IrMarkerName, attrs?: Record<string, unknown>): void {\n  if (emitted.has(name)) return;\n  emitted.add(name);\n  emitMarker(name, attrs);\n}\n\n/** Test seam: override the transport/clock. */\nexport function __setMarkerDeps(d: Partial<MarkerDeps>): void {\n  deps = { ...defaultDeps, ...d };\n}\n\n/** Test seam: reset module state (the once-guard + deps) between cases. */\nexport function __resetMarkers(): void {\n  deps = defaultDeps;\n  emitted.clear();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,0BAA2C;AAC3C,uBAAkD;AAOlD,MAAM,UAAU,MACd,OAAO,gBAAgB,eAAe,OAAO,YAAY,QAAQ,aAAa,YAAY,IAAI,IAAI,KAAK,IAAI;AAE7G,MAAM,cAA0B,EAAE,MAAM,oBAAAA,aAAa,KAAK,QAAQ;AAElE,IAAI,OAAmB;AACvB,MAAM,UAAU,oBAAI,IAAY;AAQzB,SAAS,WAAW,MAAoB,OAAuC;AACpF,MAAI,KAAC,iCAAe,IAAI,EAAG;AAC3B,MAAI;AACF,SAAK,KAAK,aAAa,EAAE,MAAM,IAAI,KAAK,IAAI,GAAG,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AAAA,EAC5F,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,eAAe,MAAoB,OAAuC;AACxF,MAAI,QAAQ,IAAI,IAAI,EAAG;AACvB,UAAQ,IAAI,IAAI;AAChB,aAAW,MAAM,KAAK;AACxB;AAGO,SAAS,gBAAgB,GAA8B;AAC5D,SAAO,EAAE,GAAG,aAAa,GAAG,EAAE;AAChC;AAGO,SAAS,iBAAuB;AACrC,SAAO;AACP,UAAQ,MAAM;AAChB;","names":["defaultSend"]}
+{"version":3,"sources":["../src/markers.ts"],"sourcesContent":["// Runtime emission of the boot `ir.*` markers (LOAD_PROFILING_SPEC §3/§3.2, R3-46).\n//\n// The host already MERGED the receive end: it validates a forwarded\n// `{ type:'ir-marker', name, at, attrs? }` against the LP-5 allowlist\n// (`irMarkers.ts`) and brackets request→interactive, treating an accepted\n// `ir.interactive` as the root-render-commit signal (site-main\n// `routePerfMessage`/`perfTimeline`). This module is the SANDBOX-side emitter for\n// the boot marks the SDK owns — `ir.fmp` (first meaningful paint) and\n// `ir.interactive` (root render commit) — forwarded over the same transport as\n// `reportReady()` (`ready.ts`). The per-marker timestamp is the sandbox-relative\n// `performance.now()` at emission (§3.2).\n//\n// Mirrors `ready.ts`'s dependency seam so the emission is unit-testable without a\n// host transport, and is idempotent per name so React StrictMode's double-invoke\n// (or any re-commit) can't mint a boot mark twice. The seam and the `realNow`\n// fallback are a deliberate second copy, not an oversight: sharing them would mean\n// a new module-level export, and this package's surface is additive-only, so every\n// export is a public subpath API a pinned app can import forever.\nimport { sendMessage as defaultSend } from './sandboxUtils';\nimport { isIrMarkerName, type IrMarkerName } from './irMarkers';\n\ninterface MarkerDeps {\n  send: (type: string, data?: Record<string, unknown>) => void;\n  now: () => number;\n}\n\nconst realNow = (): number =>\n  typeof performance !== 'undefined' && typeof performance.now === 'function' ? performance.now() : Date.now();\n\nconst defaultDeps: MarkerDeps = { send: defaultSend, now: realNow };\n\nlet deps: MarkerDeps = defaultDeps;\nconst emitted = new Set<string>();\n\n/**\n * Forward one `ir.*` marker to the host (`ir-marker`). The host re-validates against\n * the allowlist, so a bad name/attr is dropped there; we only emit names the SDK\n * itself owns. A transport that isn't ready yet is swallowed — a missing boot mark\n * must never break the app's boot.\n */\nexport function emitMarker(name: IrMarkerName, attrs?: Record<string, unknown>): void {\n  if (!isIrMarkerName(name)) return;\n  try {\n    deps.send('ir-marker', { name, at: deps.now(), ...(attrs !== undefined ? { attrs } : {}) });\n  } catch {\n    /* transport not ready — boot continues; the host simply lacks this mark */\n  }\n}\n\n/** Emit a boot one-shot at most once per name (idempotent across StrictMode/re-commit). */\nexport function emitMarkerOnce(name: IrMarkerName, attrs?: Record<string, unknown>): void {\n  if (emitted.has(name)) return;\n  emitted.add(name);\n  emitMarker(name, attrs);\n}\n\n/** Test seam: override the transport/clock. */\nexport function __setMarkerDeps(d: Partial<MarkerDeps>): void {\n  deps = { ...defaultDeps, ...d };\n}\n\n/** Test seam: reset module state (the once-guard + deps) between cases. */\nexport function __resetMarkers(): void {\n  deps = defaultDeps;\n  emitted.clear();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBA,0BAA2C;AAC3C,uBAAkD;AAOlD,MAAM,UAAU,MACd,OAAO,gBAAgB,eAAe,OAAO,YAAY,QAAQ,aAAa,YAAY,IAAI,IAAI,KAAK,IAAI;AAE7G,MAAM,cAA0B,EAAE,MAAM,oBAAAA,aAAa,KAAK,QAAQ;AAElE,IAAI,OAAmB;AACvB,MAAM,UAAU,oBAAI,IAAY;AAQzB,SAAS,WAAW,MAAoB,OAAuC;AACpF,MAAI,KAAC,iCAAe,IAAI,EAAG;AAC3B,MAAI;AACF,SAAK,KAAK,aAAa,EAAE,MAAM,IAAI,KAAK,IAAI,GAAG,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AAAA,EAC5F,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,eAAe,MAAoB,OAAuC;AACxF,MAAI,QAAQ,IAAI,IAAI,EAAG;AACvB,UAAQ,IAAI,IAAI;AAChB,aAAW,MAAM,KAAK;AACxB;AAGO,SAAS,gBAAgB,GAA8B;AAC5D,SAAO,EAAE,GAAG,aAAa,GAAG,EAAE;AAChC;AAGO,SAAS,iBAAuB;AACrC,SAAO;AACP,UAAQ,MAAM;AAChB;","names":["defaultSend"]}

package/dist/markers.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/markers.ts"],"sourcesContent":["// Runtime emission of the boot `ir.*` markers (LOAD_PROFILING_SPEC §3/§3.2, R3-46).\n//\n// The host already MERGED the receive end: it validates a forwarded\n// `{ type:'ir-marker', name, at, attrs? }` against the LP-5 allowlist\n// (`irMarkers.ts`) and brackets request→interactive, treating an accepted\n// `ir.interactive` as the root-render-commit signal (site-main\n// `routePerfMessage`/`perfTimeline`). This module is the SANDBOX-side emitter for\n// the boot marks the SDK owns — `ir.fmp` (first meaningful paint) and\n// `ir.interactive` (root render commit) — forwarded over the same transport as\n// `reportReady()` (`ready.ts`). The per-marker timestamp is the sandbox-relative\n// `performance.now()` at emission (§3.2).\n//\n// Mirrors `ready.ts`'s dependency seam so the emission is unit-testable without a\n// host transport, and is idempotent per name so React StrictMode's double-invoke\n// (or any re-commit) can't mint a boot mark twice.\nimport { sendMessage as defaultSend } from './sandboxUtils';\nimport { isIrMarkerName, type IrMarkerName } from './irMarkers';\n\ninterface MarkerDeps {\n  send: (type: string, data?: Record<string, unknown>) => void;\n  now: () => number;\n}\n\nconst realNow = (): number =>\n  typeof performance !== 'undefined' && typeof performance.now === 'function' ? performance.now() : Date.now();\n\nconst defaultDeps: MarkerDeps = { send: defaultSend, now: realNow };\n\nlet deps: MarkerDeps = defaultDeps;\nconst emitted = new Set<string>();\n\n/**\n * Forward one `ir.*` marker to the host (`ir-marker`). The host re-validates against\n * the allowlist, so a bad name/attr is dropped there; we only emit names the SDK\n * itself owns. A transport that isn't ready yet is swallowed — a missing boot mark\n * must never break the app's boot.\n */\nexport function emitMarker(name: IrMarkerName, attrs?: Record<string, unknown>): void {\n  if (!isIrMarkerName(name)) return;\n  try {\n    deps.send('ir-marker', { name, at: deps.now(), ...(attrs !== undefined ? { attrs } : {}) });\n  } catch {\n    /* transport not ready — boot continues; the host simply lacks this mark */\n  }\n}\n\n/** Emit a boot one-shot at most once per name (idempotent across StrictMode/re-commit). */\nexport function emitMarkerOnce(name: IrMarkerName, attrs?: Record<string, unknown>): void {\n  if (emitted.has(name)) return;\n  emitted.add(name);\n  emitMarker(name, attrs);\n}\n\n/** Test seam: override the transport/clock. */\nexport function __setMarkerDeps(d: Partial<MarkerDeps>): void {\n  deps = { ...defaultDeps, ...d };\n}\n\n/** Test seam: reset module state (the once-guard + deps) between cases. */\nexport function __resetMarkers(): void {\n  deps = defaultDeps;\n  emitted.clear();\n}\n"],"mappings":";AAeA,SAAS,eAAe,mBAAmB;AAC3C,SAAS,sBAAyC;AAOlD,MAAM,UAAU,MACd,OAAO,gBAAgB,eAAe,OAAO,YAAY,QAAQ,aAAa,YAAY,IAAI,IAAI,KAAK,IAAI;AAE7G,MAAM,cAA0B,EAAE,MAAM,aAAa,KAAK,QAAQ;AAElE,IAAI,OAAmB;AACvB,MAAM,UAAU,oBAAI,IAAY;AAQzB,SAAS,WAAW,MAAoB,OAAuC;AACpF,MAAI,CAAC,eAAe,IAAI,EAAG;AAC3B,MAAI;AACF,SAAK,KAAK,aAAa,EAAE,MAAM,IAAI,KAAK,IAAI,GAAG,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AAAA,EAC5F,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,eAAe,MAAoB,OAAuC;AACxF,MAAI,QAAQ,IAAI,IAAI,EAAG;AACvB,UAAQ,IAAI,IAAI;AAChB,aAAW,MAAM,KAAK;AACxB;AAGO,SAAS,gBAAgB,GAA8B;AAC5D,SAAO,EAAE,GAAG,aAAa,GAAG,EAAE;AAChC;AAGO,SAAS,iBAAuB;AACrC,SAAO;AACP,UAAQ,MAAM;AAChB;","names":[]}
+{"version":3,"sources":["../src/markers.ts"],"sourcesContent":["// Runtime emission of the boot `ir.*` markers (LOAD_PROFILING_SPEC §3/§3.2, R3-46).\n//\n// The host already MERGED the receive end: it validates a forwarded\n// `{ type:'ir-marker', name, at, attrs? }` against the LP-5 allowlist\n// (`irMarkers.ts`) and brackets request→interactive, treating an accepted\n// `ir.interactive` as the root-render-commit signal (site-main\n// `routePerfMessage`/`perfTimeline`). This module is the SANDBOX-side emitter for\n// the boot marks the SDK owns — `ir.fmp` (first meaningful paint) and\n// `ir.interactive` (root render commit) — forwarded over the same transport as\n// `reportReady()` (`ready.ts`). The per-marker timestamp is the sandbox-relative\n// `performance.now()` at emission (§3.2).\n//\n// Mirrors `ready.ts`'s dependency seam so the emission is unit-testable without a\n// host transport, and is idempotent per name so React StrictMode's double-invoke\n// (or any re-commit) can't mint a boot mark twice. The seam and the `realNow`\n// fallback are a deliberate second copy, not an oversight: sharing them would mean\n// a new module-level export, and this package's surface is additive-only, so every\n// export is a public subpath API a pinned app can import forever.\nimport { sendMessage as defaultSend } from './sandboxUtils';\nimport { isIrMarkerName, type IrMarkerName } from './irMarkers';\n\ninterface MarkerDeps {\n  send: (type: string, data?: Record<string, unknown>) => void;\n  now: () => number;\n}\n\nconst realNow = (): number =>\n  typeof performance !== 'undefined' && typeof performance.now === 'function' ? performance.now() : Date.now();\n\nconst defaultDeps: MarkerDeps = { send: defaultSend, now: realNow };\n\nlet deps: MarkerDeps = defaultDeps;\nconst emitted = new Set<string>();\n\n/**\n * Forward one `ir.*` marker to the host (`ir-marker`). The host re-validates against\n * the allowlist, so a bad name/attr is dropped there; we only emit names the SDK\n * itself owns. A transport that isn't ready yet is swallowed — a missing boot mark\n * must never break the app's boot.\n */\nexport function emitMarker(name: IrMarkerName, attrs?: Record<string, unknown>): void {\n  if (!isIrMarkerName(name)) return;\n  try {\n    deps.send('ir-marker', { name, at: deps.now(), ...(attrs !== undefined ? { attrs } : {}) });\n  } catch {\n    /* transport not ready — boot continues; the host simply lacks this mark */\n  }\n}\n\n/** Emit a boot one-shot at most once per name (idempotent across StrictMode/re-commit). */\nexport function emitMarkerOnce(name: IrMarkerName, attrs?: Record<string, unknown>): void {\n  if (emitted.has(name)) return;\n  emitted.add(name);\n  emitMarker(name, attrs);\n}\n\n/** Test seam: override the transport/clock. */\nexport function __setMarkerDeps(d: Partial<MarkerDeps>): void {\n  deps = { ...defaultDeps, ...d };\n}\n\n/** Test seam: reset module state (the once-guard + deps) between cases. */\nexport function __resetMarkers(): void {\n  deps = defaultDeps;\n  emitted.clear();\n}\n"],"mappings":";AAkBA,SAAS,eAAe,mBAAmB;AAC3C,SAAS,sBAAyC;AAOlD,MAAM,UAAU,MACd,OAAO,gBAAgB,eAAe,OAAO,YAAY,QAAQ,aAAa,YAAY,IAAI,IAAI,KAAK,IAAI;AAE7G,MAAM,cAA0B,EAAE,MAAM,aAAa,KAAK,QAAQ;AAElE,IAAI,OAAmB;AACvB,MAAM,UAAU,oBAAI,IAAY;AAQzB,SAAS,WAAW,MAAoB,OAAuC;AACpF,MAAI,CAAC,eAAe,IAAI,EAAG;AAC3B,MAAI;AACF,SAAK,KAAK,aAAa,EAAE,MAAM,IAAI,KAAK,IAAI,GAAG,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AAAA,EAC5F,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,eAAe,MAAoB,OAAuC;AACxF,MAAI,QAAQ,IAAI,IAAI,EAAG;AACvB,UAAQ,IAAI,IAAI;AAChB,aAAW,MAAM,KAAK;AACxB;AAGO,SAAS,gBAAgB,GAA8B;AAC5D,SAAO,EAAE,GAAG,aAAa,GAAG,EAAE;AAChC;AAGO,SAAS,iBAAuB;AACrC,SAAO;AACP,UAAQ,MAAM;AAChB;","names":[]}

package/dist/moduleCache.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/moduleCache.tsx"],"sourcesContent":["// based on: https://www.bbss.dev/posts/react-learn-suspense/#fetchcache-provider\n\nimport { createContext, ReactNode, useCallback, useState } from 'react';\nimport { EvaluationContext } from './sandboxTypes';\nimport { addListener } from './sandboxUtils';\nimport { COMPILE } from './generated/protocol';\n\nexport class ModuleCache {\n  nameResolutionPromises: Record<string, Promise<string>> = {};\n  evaluationContextPromises: Record<string, Promise<EvaluationContext>> = {};\n\n  constructor() {\n    // reset cache on compile\n    addListener(COMPILE, () => {\n      // NOTE: THIS CAUSES AN UNNECESSARY RELOAD\n      // the <Include> component's module evaluation context promise is replaced\n      // with a new promise for the same value when a compilation occurs which\n      // doesn't affect the current module. Commenting out the following lines\n      // eliminates the unnecessary component state loss.\n      // this.nameResolutionPromises = {};\n      // this.evaluationContextPromises = {};\n    });\n  }\n\n  private getCacheKey(mod: EvaluationContext, moduleName: string): string {\n    return `${mod.evaluation.module.filepath}|${moduleName}`;\n  }\n\n  resolveModuleName(moduleName: string, baseModule?: EvaluationContext): Promise<string> {\n    // note: uses current module as base module if none specified by caller\n    // @ts-ignore\n    const mod = baseModule ?? (module as EvaluationContext);\n    const cacheKey = this.getCacheKey(mod, moduleName);\n    if (!(cacheKey in this.nameResolutionPromises)) {\n      this.nameResolutionPromises[cacheKey] = mod.resolve(moduleName);\n    }\n    return this.nameResolutionPromises[cacheKey];\n  }\n\n  getEvaluationContext(moduleName: string, baseModule?: EvaluationContext): Promise<EvaluationContext> {\n    // note: uses current module as base module if none specified by caller\n    // @ts-ignore\n    const mod = baseModule ?? (module as EvaluationContext);\n    const cacheKey = this.getCacheKey(mod, moduleName);\n    if (!(cacheKey in this.evaluationContextPromises)) {\n      this.evaluationContextPromises[cacheKey] = mod.getModuleEvaluationContext(moduleName);\n    }\n    return this.evaluationContextPromises[cacheKey];\n  }\n}\n\nexport const ModuleCacheContext = createContext<null | ModuleCache>(null);\n\nexport const ModuleCacheContextProvider = ({\n  children,\n  moduleCache,\n}: {\n  children: ReactNode;\n  moduleCache: ModuleCache;\n}) => {\n  return <ModuleCacheContext.Provider value={moduleCache}>{children}</ModuleCacheContext.Provider>;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4DS;AA1DT,mBAAgE;AAEhE,0BAA4B;AAC5B,sBAAwB;AAEjB,MAAM,YAAY;AAAA,EAIvB,cAAc;AAHd,kCAA0D,CAAC;AAC3D,qCAAwE,CAAC;AAIvE,yCAAY,yBAAS,MAAM;AAAA,IAQ3B,CAAC;AAAA,EACH;AAAA,EAEQ,YAAY,KAAwB,YAA4B;AACtE,WAAO,GAAG,IAAI,WAAW,OAAO,QAAQ,IAAI,UAAU;AAAA,EACxD;AAAA,EAEA,kBAAkB,YAAoB,YAAiD;AAGrF,UAAM,MAAM,cAAe;AAC3B,UAAM,WAAW,KAAK,YAAY,KAAK,UAAU;AACjD,QAAI,EAAE,YAAY,KAAK,yBAAyB;AAC9C,WAAK,uBAAuB,QAAQ,IAAI,IAAI,QAAQ,UAAU;AAAA,IAChE;AACA,WAAO,KAAK,uBAAuB,QAAQ;AAAA,EAC7C;AAAA,EAEA,qBAAqB,YAAoB,YAA4D;AAGnG,UAAM,MAAM,cAAe;AAC3B,UAAM,WAAW,KAAK,YAAY,KAAK,UAAU;AACjD,QAAI,EAAE,YAAY,KAAK,4BAA4B;AACjD,WAAK,0BAA0B,QAAQ,IAAI,IAAI,2BAA2B,UAAU;AAAA,IACtF;AACA,WAAO,KAAK,0BAA0B,QAAQ;AAAA,EAChD;AACF;AAEO,MAAM,yBAAqB,4BAAkC,IAAI;AAEjE,MAAM,6BAA6B,CAAC;AAAA,EACzC;AAAA,EACA;AACF,MAGM;AACJ,SAAO,4CAAC,mBAAmB,UAAnB,EAA4B,OAAO,aAAc,UAAS;AACpE;","names":[]}
+{"version":3,"sources":["../src/moduleCache.tsx"],"sourcesContent":["// based on: https://www.bbss.dev/posts/react-learn-suspense/#fetchcache-provider\n\nimport { createContext, ReactNode } from 'react';\nimport { EvaluationContext } from './sandboxTypes';\nimport { addListener } from './sandboxUtils';\nimport { COMPILE } from './generated/protocol';\n\nexport class ModuleCache {\n  nameResolutionPromises: Record<string, Promise<string>> = {};\n  evaluationContextPromises: Record<string, Promise<EvaluationContext>> = {};\n\n  constructor() {\n    // A compile-time cache reset, deliberately NOT performed. Resetting here\n    // replaced every <Include>'s module-evaluation-context promise with a new\n    // promise for the same value on EVERY compilation, including compilations that\n    // do not affect that module, so the component lost its state for nothing. The\n    // listener stays registered (and the reset stays here, disabled) because the\n    // fix is to scope the reset to the modules a compile actually changed, not to\n    // drop the seam.\n    addListener(COMPILE, () => {\n      // this.nameResolutionPromises = {};\n      // this.evaluationContextPromises = {};\n    });\n  }\n\n  private getCacheKey(mod: EvaluationContext, moduleName: string): string {\n    return `${mod.evaluation.module.filepath}|${moduleName}`;\n  }\n\n  resolveModuleName(moduleName: string, baseModule?: EvaluationContext): Promise<string> {\n    // note: uses current module as base module if none specified by caller\n    // @ts-ignore\n    const mod = baseModule ?? (module as EvaluationContext);\n    const cacheKey = this.getCacheKey(mod, moduleName);\n    if (!(cacheKey in this.nameResolutionPromises)) {\n      this.nameResolutionPromises[cacheKey] = mod.resolve(moduleName);\n    }\n    return this.nameResolutionPromises[cacheKey];\n  }\n\n  getEvaluationContext(moduleName: string, baseModule?: EvaluationContext): Promise<EvaluationContext> {\n    // note: uses current module as base module if none specified by caller\n    // @ts-ignore\n    const mod = baseModule ?? (module as EvaluationContext);\n    const cacheKey = this.getCacheKey(mod, moduleName);\n    if (!(cacheKey in this.evaluationContextPromises)) {\n      this.evaluationContextPromises[cacheKey] = mod.getModuleEvaluationContext(moduleName);\n    }\n    return this.evaluationContextPromises[cacheKey];\n  }\n}\n\nexport const ModuleCacheContext = createContext<null | ModuleCache>(null);\n\nexport const ModuleCacheContextProvider = ({\n  children,\n  moduleCache,\n}: {\n  children: ReactNode;\n  moduleCache: ModuleCache;\n}) => {\n  return <ModuleCacheContext.Provider value={moduleCache}>{children}</ModuleCacheContext.Provider>;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6DS;AA3DT,mBAAyC;AAEzC,0BAA4B;AAC5B,sBAAwB;AAEjB,MAAM,YAAY;AAAA,EAIvB,cAAc;AAHd,kCAA0D,CAAC;AAC3D,qCAAwE,CAAC;AAUvE,yCAAY,yBAAS,MAAM;AAAA,IAG3B,CAAC;AAAA,EACH;AAAA,EAEQ,YAAY,KAAwB,YAA4B;AACtE,WAAO,GAAG,IAAI,WAAW,OAAO,QAAQ,IAAI,UAAU;AAAA,EACxD;AAAA,EAEA,kBAAkB,YAAoB,YAAiD;AAGrF,UAAM,MAAM,cAAe;AAC3B,UAAM,WAAW,KAAK,YAAY,KAAK,UAAU;AACjD,QAAI,EAAE,YAAY,KAAK,yBAAyB;AAC9C,WAAK,uBAAuB,QAAQ,IAAI,IAAI,QAAQ,UAAU;AAAA,IAChE;AACA,WAAO,KAAK,uBAAuB,QAAQ;AAAA,EAC7C;AAAA,EAEA,qBAAqB,YAAoB,YAA4D;AAGnG,UAAM,MAAM,cAAe;AAC3B,UAAM,WAAW,KAAK,YAAY,KAAK,UAAU;AACjD,QAAI,EAAE,YAAY,KAAK,4BAA4B;AACjD,WAAK,0BAA0B,QAAQ,IAAI,IAAI,2BAA2B,UAAU;AAAA,IACtF;AACA,WAAO,KAAK,0BAA0B,QAAQ;AAAA,EAChD;AACF;AAEO,MAAM,yBAAqB,4BAAkC,IAAI;AAEjE,MAAM,6BAA6B,CAAC;AAAA,EACzC;AAAA,EACA;AACF,MAGM;AACJ,SAAO,4CAAC,mBAAmB,UAAnB,EAA4B,OAAO,aAAc,UAAS;AACpE;","names":[]}

package/dist/moduleCache.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/moduleCache.tsx"],"sourcesContent":["// based on: https://www.bbss.dev/posts/react-learn-suspense/#fetchcache-provider\n\nimport { createContext, ReactNode, useCallback, useState } from 'react';\nimport { EvaluationContext } from './sandboxTypes';\nimport { addListener } from './sandboxUtils';\nimport { COMPILE } from './generated/protocol';\n\nexport class ModuleCache {\n  nameResolutionPromises: Record<string, Promise<string>> = {};\n  evaluationContextPromises: Record<string, Promise<EvaluationContext>> = {};\n\n  constructor() {\n    // reset cache on compile\n    addListener(COMPILE, () => {\n      // NOTE: THIS CAUSES AN UNNECESSARY RELOAD\n      // the <Include> component's module evaluation context promise is replaced\n      // with a new promise for the same value when a compilation occurs which\n      // doesn't affect the current module. Commenting out the following lines\n      // eliminates the unnecessary component state loss.\n      // this.nameResolutionPromises = {};\n      // this.evaluationContextPromises = {};\n    });\n  }\n\n  private getCacheKey(mod: EvaluationContext, moduleName: string): string {\n    return `${mod.evaluation.module.filepath}|${moduleName}`;\n  }\n\n  resolveModuleName(moduleName: string, baseModule?: EvaluationContext): Promise<string> {\n    // note: uses current module as base module if none specified by caller\n    // @ts-ignore\n    const mod = baseModule ?? (module as EvaluationContext);\n    const cacheKey = this.getCacheKey(mod, moduleName);\n    if (!(cacheKey in this.nameResolutionPromises)) {\n      this.nameResolutionPromises[cacheKey] = mod.resolve(moduleName);\n    }\n    return this.nameResolutionPromises[cacheKey];\n  }\n\n  getEvaluationContext(moduleName: string, baseModule?: EvaluationContext): Promise<EvaluationContext> {\n    // note: uses current module as base module if none specified by caller\n    // @ts-ignore\n    const mod = baseModule ?? (module as EvaluationContext);\n    const cacheKey = this.getCacheKey(mod, moduleName);\n    if (!(cacheKey in this.evaluationContextPromises)) {\n      this.evaluationContextPromises[cacheKey] = mod.getModuleEvaluationContext(moduleName);\n    }\n    return this.evaluationContextPromises[cacheKey];\n  }\n}\n\nexport const ModuleCacheContext = createContext<null | ModuleCache>(null);\n\nexport const ModuleCacheContextProvider = ({\n  children,\n  moduleCache,\n}: {\n  children: ReactNode;\n  moduleCache: ModuleCache;\n}) => {\n  return <ModuleCacheContext.Provider value={moduleCache}>{children}</ModuleCacheContext.Provider>;\n};\n"],"mappings":";AA4DS;AA1DT,SAAS,qBAAuD;AAEhE,SAAS,mBAAmB;AAC5B,SAAS,eAAe;AAEjB,MAAM,YAAY;AAAA,EAIvB,cAAc;AAHd,kCAA0D,CAAC;AAC3D,qCAAwE,CAAC;AAIvE,gBAAY,SAAS,MAAM;AAAA,IAQ3B,CAAC;AAAA,EACH;AAAA,EAEQ,YAAY,KAAwB,YAA4B;AACtE,WAAO,GAAG,IAAI,WAAW,OAAO,QAAQ,IAAI,UAAU;AAAA,EACxD;AAAA,EAEA,kBAAkB,YAAoB,YAAiD;AAGrF,UAAM,MAAM,cAAe;AAC3B,UAAM,WAAW,KAAK,YAAY,KAAK,UAAU;AACjD,QAAI,EAAE,YAAY,KAAK,yBAAyB;AAC9C,WAAK,uBAAuB,QAAQ,IAAI,IAAI,QAAQ,UAAU;AAAA,IAChE;AACA,WAAO,KAAK,uBAAuB,QAAQ;AAAA,EAC7C;AAAA,EAEA,qBAAqB,YAAoB,YAA4D;AAGnG,UAAM,MAAM,cAAe;AAC3B,UAAM,WAAW,KAAK,YAAY,KAAK,UAAU;AACjD,QAAI,EAAE,YAAY,KAAK,4BAA4B;AACjD,WAAK,0BAA0B,QAAQ,IAAI,IAAI,2BAA2B,UAAU;AAAA,IACtF;AACA,WAAO,KAAK,0BAA0B,QAAQ;AAAA,EAChD;AACF;AAEO,MAAM,qBAAqB,cAAkC,IAAI;AAEjE,MAAM,6BAA6B,CAAC;AAAA,EACzC;AAAA,EACA;AACF,MAGM;AACJ,SAAO,oBAAC,mBAAmB,UAAnB,EAA4B,OAAO,aAAc,UAAS;AACpE;","names":[]}
+{"version":3,"sources":["../src/moduleCache.tsx"],"sourcesContent":["// based on: https://www.bbss.dev/posts/react-learn-suspense/#fetchcache-provider\n\nimport { createContext, ReactNode } from 'react';\nimport { EvaluationContext } from './sandboxTypes';\nimport { addListener } from './sandboxUtils';\nimport { COMPILE } from './generated/protocol';\n\nexport class ModuleCache {\n  nameResolutionPromises: Record<string, Promise<string>> = {};\n  evaluationContextPromises: Record<string, Promise<EvaluationContext>> = {};\n\n  constructor() {\n    // A compile-time cache reset, deliberately NOT performed. Resetting here\n    // replaced every <Include>'s module-evaluation-context promise with a new\n    // promise for the same value on EVERY compilation, including compilations that\n    // do not affect that module, so the component lost its state for nothing. The\n    // listener stays registered (and the reset stays here, disabled) because the\n    // fix is to scope the reset to the modules a compile actually changed, not to\n    // drop the seam.\n    addListener(COMPILE, () => {\n      // this.nameResolutionPromises = {};\n      // this.evaluationContextPromises = {};\n    });\n  }\n\n  private getCacheKey(mod: EvaluationContext, moduleName: string): string {\n    return `${mod.evaluation.module.filepath}|${moduleName}`;\n  }\n\n  resolveModuleName(moduleName: string, baseModule?: EvaluationContext): Promise<string> {\n    // note: uses current module as base module if none specified by caller\n    // @ts-ignore\n    const mod = baseModule ?? (module as EvaluationContext);\n    const cacheKey = this.getCacheKey(mod, moduleName);\n    if (!(cacheKey in this.nameResolutionPromises)) {\n      this.nameResolutionPromises[cacheKey] = mod.resolve(moduleName);\n    }\n    return this.nameResolutionPromises[cacheKey];\n  }\n\n  getEvaluationContext(moduleName: string, baseModule?: EvaluationContext): Promise<EvaluationContext> {\n    // note: uses current module as base module if none specified by caller\n    // @ts-ignore\n    const mod = baseModule ?? (module as EvaluationContext);\n    const cacheKey = this.getCacheKey(mod, moduleName);\n    if (!(cacheKey in this.evaluationContextPromises)) {\n      this.evaluationContextPromises[cacheKey] = mod.getModuleEvaluationContext(moduleName);\n    }\n    return this.evaluationContextPromises[cacheKey];\n  }\n}\n\nexport const ModuleCacheContext = createContext<null | ModuleCache>(null);\n\nexport const ModuleCacheContextProvider = ({\n  children,\n  moduleCache,\n}: {\n  children: ReactNode;\n  moduleCache: ModuleCache;\n}) => {\n  return <ModuleCacheContext.Provider value={moduleCache}>{children}</ModuleCacheContext.Provider>;\n};\n"],"mappings":";AA6DS;AA3DT,SAAS,qBAAgC;AAEzC,SAAS,mBAAmB;AAC5B,SAAS,eAAe;AAEjB,MAAM,YAAY;AAAA,EAIvB,cAAc;AAHd,kCAA0D,CAAC;AAC3D,qCAAwE,CAAC;AAUvE,gBAAY,SAAS,MAAM;AAAA,IAG3B,CAAC;AAAA,EACH;AAAA,EAEQ,YAAY,KAAwB,YAA4B;AACtE,WAAO,GAAG,IAAI,WAAW,OAAO,QAAQ,IAAI,UAAU;AAAA,EACxD;AAAA,EAEA,kBAAkB,YAAoB,YAAiD;AAGrF,UAAM,MAAM,cAAe;AAC3B,UAAM,WAAW,KAAK,YAAY,KAAK,UAAU;AACjD,QAAI,EAAE,YAAY,KAAK,yBAAyB;AAC9C,WAAK,uBAAuB,QAAQ,IAAI,IAAI,QAAQ,UAAU;AAAA,IAChE;AACA,WAAO,KAAK,uBAAuB,QAAQ;AAAA,EAC7C;AAAA,EAEA,qBAAqB,YAAoB,YAA4D;AAGnG,UAAM,MAAM,cAAe;AAC3B,UAAM,WAAW,KAAK,YAAY,KAAK,UAAU;AACjD,QAAI,EAAE,YAAY,KAAK,4BAA4B;AACjD,WAAK,0BAA0B,QAAQ,IAAI,IAAI,2BAA2B,UAAU;AAAA,IACtF;AACA,WAAO,KAAK,0BAA0B,QAAQ;AAAA,EAChD;AACF;AAEO,MAAM,qBAAqB,cAAkC,IAAI;AAEjE,MAAM,6BAA6B,CAAC;AAAA,EACzC;AAAA,EACA;AACF,MAGM;AACJ,SAAO,oBAAC,mBAAmB,UAAnB,EAA4B,OAAO,aAAc,UAAS;AACpE;","names":[]}

package/dist/mounts.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/mounts.ts"],"sourcesContent":["import { APP_ROOT } from '@immediately-run/platform-constants';\n\nimport { useEffect, useState } from 'react';\nimport { protocolRequest, sendMessage, addListener } from './sandboxUtils';\nimport { createPushChannel } from './pushChannel';\nimport { getHostRuntime } from './hostRuntime';\nimport { mountMatches } from './mountMatch';\n// R3-166 — the `spaces:*` family is GENERATED from the capability descriptor set\n// (`scripts/codegen-prototype/descriptors.spaces.mjs`) rather than hand-written here.\n// Re-exported from this module so every existing import path keeps working: the\n// swap is a no-op to consumers (SDK_SIMPLIFICATION_SPEC §7 step 3), which is\n// asserted by the emitted-`.d.ts` before/after comparison, not assumed.\n//\n// `Role` is imported (not only re-exported) because `Invite` below still uses it —\n// the invite methods are the same `spaces:` scheme but are NOT yet described, so\n// they remain hand-written. That split is the next migration increment.\nimport type { Role, SpaceInfo, Member, GrantRecord } from './generated/spaces';\nexport type { Role, SpaceInfo, Member, ResolvedUser, GrantRecord } from './generated/spaces';\nexport {\n  listSpaces,\n  listAllSpaces,\n  getSpaceMembers,\n  inviteToSpace,\n  unshareSpace,\n  setSpaceRole,\n  lookupUser,\n  listGrants,\n  revokeGrant,\n} from './generated/spaces';\n// Type-only: `tasks.ts` registers a host listener at module load, so we reuse the\n// FileCap SHAPE without pulling that side effect into every `mounts` importer.\nimport type { FileCap } from './tasks';\nimport {\n  INVITATIONS,\n  MOUNT_ADD,\n  MOUNT_REMOVE,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  REQUEST_INVITATIONS,\n  REQUEST_MOUNTS,\n  REQUEST_SESSION_MOUNTS,\n  SESSION_MOUNTS,\n} from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/**\n * The absolute path where this app's own repository filesystem is mounted\n * (FILE_SHARING_SPEC §11.2). Prefer this over hardcoding `/app`: the repo is\n * dual-mounted at both `/app` (back-compat) and its canonical `/mnt/{hash}`\n * address, and this returns the canonical one the host reports. Falls back to\n * `/app` when the host hasn't reported a canonical path (older host / before the\n * report arrives) — both paths are live, so either resolves the same files.\n */\nexport const getAppMountPath = (): string => getHostRuntime()?.appMountPath ?? APP_ROOT;\n\n/**\n * A filesystem mount available to the sandbox, mirrored from the host window.\n *\n * Mounts appear on demand — call {@link openSettings} for this app's own settings,\n * or {@link mountSpace} / {@link requestMount} to mount a Firestore-backed \"space\".\n * Read or subscribe to the set, then access the files through the `fs` module at\n * the mount's `path`.\n */\nexport interface SandboxMount {\n  /** Absolute path where the mount is reachable (e.g. `/spaces/{id}`). */\n  path: string;\n  /** Backend kind, e.g. `'firestore'`. */\n  type: string;\n  /** Optional stable identifier (the spaceId, for spaces). */\n  id?: string;\n  /**\n   * Access mode of the granted view: `'rw'` (read-write) or `'ro'` (read-only).\n   * A live role downgrade re-announces the same mount with `mode: 'ro'`; apps\n   * observing `onMountsChange` see the change and writes start failing `EROFS`.\n   * Absent on the primary repo mount (treated as read-write).\n   */\n  mode?: 'ro' | 'rw';\n  /**\n   * Human-readable label for the mount — the space's display name, or the repo\n   * label for the primary working-tree mount (R3-69). Use this to show users and\n   * agents *what* a mount is: the `path` (`/mnt/{hash}`) and `id` (the spaceId)\n   * are opaque, and space names are not unique, so neither alone tells you which\n   * filesystem you're looking at. Absent when the host can't resolve a name\n   * (older host, or a name it never learned) — fall back to `id`/`path`.\n   */\n  name?: string;\n  /**\n   * The granted scopes of this mount (plan 12 §8.7 / §F): each `{subtree, mode}`\n   * is a path prefix you hold and at what access, at the mount's backend-natural\n   * paths. Use it to reason about per-path writability — which subtree is `rw` —\n   * WITHOUT probing `EROFS`. A single whole-mount grant is `[{ subtree: '/', mode }]`.\n   * Absent on the primary repo mount and on an older host that doesn't report it.\n   */\n  rules?: MountRule[];\n}\n\n/** One granted scope of a mount (plan 12 §F): a backend-natural path prefix and\n *  the access mode there. The most specific (longest) matching rule governs a path. */\nexport interface MountRule {\n  subtree: string;\n  mode: 'ro' | 'rw';\n}\n\n/**\n * Why a mounted filesystem was removed, surfaced on the removed descriptor so an\n * app can say *why* it vanished instead of failing mutely (auth-mount §\"mount-remove\"\n * / AM2-4):\n * - `revoked` — a durable grant was revoked (revokeGrant / consent withdrawal);\n * - `unshared` — the granting user's membership was removed (or downgraded out);\n * - `signed-out` — sign-out tore down every mount;\n * - `unmounted` — the app's own `unmountSpace` (or region teardown);\n * - `deleted` — the space was soft-deleted.\n * An older host that sends no reason is read as `'revoked'` (most conservative).\n */\nexport type MountRemoveReason = 'revoked' | 'unshared' | 'signed-out' | 'unmounted' | 'deleted';\n\n/** A descriptor delivered as REMOVED to a mounts-change listener: the mount that\n *  went away, plus the `reason` it did. */\nexport interface RemovedMount extends SandboxMount {\n  reason: MountRemoveReason;\n}\n\ninterface MountService {\n  getMounts(): SandboxMount[];\n  onChange(listener: (mounts: SandboxMount[], removed: RemovedMount[]) => void): { dispose(): void };\n}\n\n// The stable key of a mount: its `id` (spaceId) when present, else its `path`.\n// Matches the sandbox `MountService.mountKey` so add/replace/remove agree on both\n// sides of the wire (a role downgrade re-announces the SAME key with `mode: 'ro'`).\nconst mountKey = (m: SandboxMount): string => m.id ?? m.path;\n\nconst MOUNT_REMOVE_REASONS: ReadonlySet<string> = new Set<MountRemoveReason>([\n  'revoked',\n  'unshared',\n  'signed-out',\n  'unmounted',\n  'deleted',\n]);\n\n// Normalize an over-the-wire `mount-remove` reason; an absent/unknown value (older\n// host) reads as `'revoked'`, the most conservative reading (mirrors the sandbox).\nconst asMountRemoveReason = (value: unknown): MountRemoveReason =>\n  typeof value === 'string' && MOUNT_REMOVE_REASONS.has(value) ? (value as MountRemoveReason) : 'revoked';\n\n// The injected sandbox-bundler mount service (`module.evaluation.module.bundler.mounts`),\n// or null when the SDK is npm-fetched with no injection — same dual-mode shape as\n// `sandboxUtils.transport()` and the metadata emitter (SDK_PACKAGING_SPEC §4/§8).\n/** @deprecated-path The injected `bundler.mounts` read — window opened 2026-08-25\n *  (R3-278). The protocol equivalent is `transportMountService()` below (the\n *  `mount-add`/`mount-remove` mirror + `request-mounts` replay), which the dual-mode\n *  chooser already falls back to. Injection stays preferred for byte-compat through\n *  the window; see DEPRECATION_CANDIDATES.md.\n */\nconst injectedMountService = (): MountService | null => {\n  try {\n    // @ts-ignore - injected by the sandbox runtime\n    const svc = module?.evaluation?.module?.bundler?.mounts;\n    return svc && typeof svc.getMounts === 'function' ? svc : null;\n  } catch {\n    return null;\n  }\n};\n\n// Transport-backed descriptor cache (R3-51b): the npm-fetched fallback that builds\n// the same `getMounts()`/`onChange()` view the injected `bundler.mounts` provides,\n// directly from the host's `mount-add`/`mount-remove` messages over the §4 transport.\n// The host already posts these (it's how the in-iframe bundler service is populated);\n// the `MessagePort` a `mount-add` transfers is consumed by the sandbox runtime to wire\n// ZenFS and is irrelevant here — the SDK only mirrors the *descriptors*. A lazy\n// singleton so `getMounts`/`onMountsChange` share one cache, one subscription, and one\n// `request-mounts` replay (the host re-announces every current mount, like a poll).\nlet transportSvc: MountService | null = null;\n\nconst transportMountService = (): MountService => {\n  if (transportSvc) return transportSvc;\n  let mounts: SandboxMount[] = [];\n  const listeners = new Set<(m: SandboxMount[], r: RemovedMount[]) => void>();\n  const fire = (removed: RemovedMount[]) => {\n    for (const l of [...listeners]) l(mounts, removed);\n  };\n\n  addListener(MOUNT_ADD, (msg: Record<string, any>) => {\n    const mount: SandboxMount | undefined = msg.mount;\n    if (!mount) return;\n    const key = mountKey(mount);\n    mounts = [...mounts.filter((m) => mountKey(m) !== key), mount];\n    fire([]);\n  });\n  addListener(MOUNT_REMOVE, (msg: Record<string, any>) => {\n    const key: string | undefined = msg.id ?? msg.path;\n    if (key == null) return;\n    const reason = asMountRemoveReason(msg.reason);\n    const removed = mounts.filter((m) => mountKey(m) === key).map((m) => ({ ...m, reason }));\n    if (removed.length === 0) return;\n    mounts = mounts.filter((m) => mountKey(m) !== key);\n    fire(removed);\n  });\n\n  // Ask the host to replay the current set (the matching `mount-add`s may have been\n  // sent before this SDK subscribed). Best-effort: a transport not yet ready throws.\n  try {\n    sendMessage(REQUEST_MOUNTS);\n  } catch {\n    /* transport not ready — the live mount-add stream still populates the cache */\n  }\n\n  transportSvc = {\n    getMounts: () => mounts,\n    onChange: (listener) => {\n      listeners.add(listener);\n      listener(mounts, []); // immediate replay to the new subscriber\n      return { dispose: () => listeners.delete(listener) };\n    },\n  };\n  return transportSvc;\n};\n\n// Phase-5 dual mode: prefer the injected bundler service (the live path, behaviour\n// byte-for-byte unchanged); fall back to the transport-built cache when npm-fetched.\nconst mountService = (): MountService => injectedMountService() ?? transportMountService();\n\n/** A predicate-style matcher for {@link findMount} / {@link waitForMount}. Any\n *  combination of coordinates; `name` matches the human-readable mount label. */\nexport type MountQuery = { type?: string; id?: string; path?: string; name?: string };\n\nconst matches = (mount: SandboxMount, query: MountQuery): boolean => mountMatches(mount, query);\n\n/**\n * Returns the mounts currently available. Poll this whenever you need a one-off\n * read; use {@link onMountsChange} or {@link useMounts} to react to changes.\n * Each descriptor carries its `id` (the spaceId), `path` (`/mnt/{hash}`) and —\n * when the host can resolve it — a human-readable `name` (R3-69), so this doubles\n * as a queryable mount→space mapping for showing or locating a mount by name.\n */\nexport const getMounts = (): SandboxMount[] => mountService().getMounts();\n\n/** Returns the first mount matching `query`, or `undefined`. */\nexport const findMount = (query: MountQuery): SandboxMount | undefined => getMounts().find((m) => matches(m, query));\n\n/**\n * Subscribe to mount changes. The listener is invoked immediately with the\n * current mounts (and an empty `removed`), then again on every change. The second\n * argument carries the descriptors REMOVED by that change, each with its `reason`\n * (AM2-4) — so an app can react to *why* a mount vanished (e.g. tell the user a\n * shared space was `unshared` vs `deleted`). It is empty on adds and on the\n * initial replay. Returns an unsubscribe fn.\n */\nexport const onMountsChange = (listener: (mounts: SandboxMount[], removed: RemovedMount[]) => void): (() => void) => {\n  const disposable = mountService().onChange(listener);\n  return () => disposable.dispose();\n};\n\n/**\n * Resolves once a mount matching `query` is present (immediately if it already\n * is). Handy for \"use it when it appears\" — e.g.\n * `await waitForMount({ type: 'firestore' })` before reading `/firestore`.\n *\n * `timeoutMs` (optional, additive) rejects with a `timeout`-coded error instead of\n * waiting forever. Omit it to keep the original unbounded behaviour — but prefer\n * setting it on any path whose caller would otherwise hang silently: a mount that\n * never arrives is indistinguishable from one that is merely slow, and an awaited\n * promise that never settles surfaces to the user as a feature that quietly does\n * nothing.\n *\n * **Hazard — `onMountsChange` calls its listener SYNCHRONOUSLY on subscribe** (the\n * documented initial replay). So when the mount is already present — the common\n * case, since callers typically `await` the host request that creates it first —\n * the callback below runs *during* the `onMountsChange(...)` call, before the\n * assignment to `unsubscribe` completes. `unsubscribe` is therefore declared with\n * `let` ABOVE the subscription and read only inside a deferred closure: writing\n * `const unsubscribe = onMountsChange(...)` and referencing it in the callback\n * throws `ReferenceError: Cannot access 'unsubscribe' before initialization` (a\n * temporal-dead-zone read) on exactly that path. That bug silently broke\n * `openSettings()` — and with it the agent's conversation memory.\n */\nexport const waitForMount = (query: MountQuery, timeoutMs?: number): Promise<SandboxMount> =>\n  awaitMatchingMount(onMountsChange, query, timeoutMs);\n\n/** The framework-free core of {@link waitForMount}, with the subscription injected\n *  so a test can drive the synchronous-initial-replay case that broke it. */\nexport const awaitMatchingMount = (\n  subscribe: (listener: (mounts: SandboxMount[]) => void) => () => void,\n  query: MountQuery,\n  timeoutMs?: number,\n): Promise<SandboxMount> =>\n  new Promise((resolve, reject) => {\n    // `let`, declared BEFORE `subscribe(...)` — see the hazard note above. A\n    // `const` bound to the subscribe call is in its temporal dead zone while the\n    // synchronous initial replay runs, and any read of it from the listener\n    // throws.\n    let unsubscribe: (() => void) | undefined;\n    let settled = false;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    // Deferred so we never dispose the subscription from inside its own initial\n    // replay, and late enough that `unsubscribe` is always assigned.\n    const stop = (): void => {\n      settled = true;\n      if (timer !== undefined) clearTimeout(timer);\n      void Promise.resolve().then(() => unsubscribe?.());\n    };\n    unsubscribe = subscribe((mounts) => {\n      if (settled) return;\n      const found = mounts.find((m) => matches(m, query));\n      if (found) {\n        stop();\n        resolve(found);\n      }\n    });\n    // The initial replay may have settled us above, before `unsubscribe` existed;\n    // `stop()`'s deferred read picks it up, so nothing more is needed here.\n    if (!settled && timeoutMs !== undefined) {\n      timer = setTimeout(() => {\n        if (settled) return;\n        stop();\n        const err = new Error(\n          `waitForMount timed out after ${timeoutMs}ms waiting for ${JSON.stringify(query)}`,\n        ) as SpaceError;\n        err.code = 'timeout';\n        reject(err);\n      }, timeoutMs);\n    }\n  });\n\n/** React hook returning the mounts currently available, re-rendering on change. */\nexport const useMounts = (): SandboxMount[] => {\n  const [mounts, setMounts] = useState<SandboxMount[]>(getMounts);\n  useEffect(() => onMountsChange(setMounts), []);\n  return mounts;\n};\n\n// ---------------------------------------------------------------------------\n// Session-scope mounts — the first-party \"App | Session\" lens (PRINCIPALS §9 B2).\n// ---------------------------------------------------------------------------\n\n/** A mount as seen through the first-party **Session** lens (PRINCIPALS_SPEC §9 B2):\n *  the session's mounts BEYOND this app's own (the editor/agent session's). This is\n *  a metadata view — no filesystem port — so it extends {@link SandboxMount} with only\n *  {@link forwardedToApp}. */\nexport interface SessionMount extends SandboxMount {\n  /** True iff this mount is ALSO in the app's own {@link useMounts} (the App lens);\n   *  `false` for a session-export-only mount visible only to the editor/agent + the\n   *  Session lens. */\n  forwardedToApp: boolean;\n}\n\n// The host pushes the session mount list ONLY to a FIRST-PARTY frame — the channel\n// is gated by the first-party-only `mounts:registry` capability (§8.9.1 / D-PRIN-4).\n// A URL-loaded/previewed app (or a fork of the File Explorer) never holds it, so the\n// push never arrives and `initial: []` stands — the Session lens is simply absent,\n// fail-closed. Mirrors the host's `session-mounts`/`request-session-mounts` wiring.\nconst sessionMountsChannel = createPushChannel<SessionMount[]>({\n  pushType: SESSION_MOUNTS,\n  requestType: REQUEST_SESSION_MOUNTS,\n  initial: [],\n  parse: (msg) => (Array.isArray(msg.mounts) ? (msg.mounts as SessionMount[]) : undefined),\n});\n\n/** The session's mounts (the \"Session\" lens superset), or `[]` when this frame is\n *  not first-party. One-off read; use {@link onSessionMountsChange}/{@link useSessionMounts}\n *  to react live. First-party only (`mounts:registry`) — a fork always sees `[]`. */\nexport const getSessionMounts = (): SessionMount[] => sessionMountsChannel.get();\n\n/** Subscribe to Session-lens mount changes. Invoked immediately with the current\n *  list (`[]` for a non-first-party frame), then on every change. Returns an\n *  unsubscribe. */\nexport const onSessionMountsChange = (listener: (mounts: SessionMount[]) => void): (() => void) =>\n  sessionMountsChannel.onChange(listener);\n\n/** React hook returning the live \"Session\" lens mount list, re-rendering on change.\n *  Empty for any non-first-party frame (the host withholds the channel), so a URL-\n *  loaded File Explorer fork renders no Session lens. */\nexport const useSessionMounts = (): SessionMount[] => sessionMountsChannel.use();\n\n// ---------------------------------------------------------------------------\n// Spaces — on-demand, shareable Firestore-backed filesystems.\n// The host owns all UX: if you aren't signed in, or the space doesn't exist or\n// isn't accessible, the parent window presents sign-in / create / request-access\n// and only then resolves these calls. See docs/specs/FILE_SHARING_SPEC.md.\n// ---------------------------------------------------------------------------\n\n/** An error from a space operation, carrying a machine-readable `code`. */\nexport interface SpaceError extends Error {\n  code:\n    | 'auth-required'\n    | 'cancelled'\n    | 'forbidden'\n    | 'not-found'\n    | 'unsupported-scheme'\n    // Client-side, never from the host: a bounded `waitForMount` gave up.\n    | 'timeout'\n    | 'unknown';\n}\n\ntype SpaceResult = { ok: true; data: unknown } | { ok: false; code: string; message: string };\n\n// Issue a spaces protocol request, unwrapping the host's {ok,data} envelope and\n// throwing a typed SpaceError on failure.\nconst request = async <T = unknown>(method: string, query: Record<string, unknown> = {}): Promise<T> => {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_SPACES], method, [query])) as SpaceResult;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'space request failed') as SpaceError;\n    err.code = (res?.code as SpaceError['code']) ?? 'unknown';\n    throw err;\n  }\n  return res.data as T;\n};\n\n// Request a space mount, then wait until the host actually registers it. The\n// host announces the mount (`mount-add`) separately from the protocol reply, so\n// an immediate read could otherwise race the mount.\nconst requestMountInternal = async (method: string, query: Record<string, unknown>): Promise<SandboxMount> => {\n  const mount = await request<SandboxMount>(method, query);\n  return waitForMount({ id: mount.id ?? mount.path });\n};\n\n/**\n * Mount a filesystem by its **universal mount id** (UI_AS_APPS_SPEC §3.5) —\n * `scheme:locator`, e.g. `space:{spaceId}` or `github:owner/repo@ref`. Backend-blind:\n * the host resolves the scheme. A scheme with no resolver rejects with\n * {@link SpaceError} `unsupported-scheme`.\n */\nexport const mount = (mountId: string): Promise<SandboxMount> => requestMountInternal('mount', { mount: mountId });\n\n/** Mount a specific space by id (e.g. one shared with you, or from a link). A thin\n *  shim over {@link mount} with the `space:` scheme. */\nexport const mountSpace = (query: { spaceId: string }): Promise<SandboxMount> => mount(`space:${query.spaceId}`);\n\n/**\n * Ask the user to grant a filesystem to this app — the §8.6 powerbox. The app\n * asks; the HOST shows the user their spaces and, for the chosen one, its PROJECT\n * FOLDERS (§8.7). The user picks ONE project — so a shared space opens scoped to\n * just that project, never the whole space — and makes an EXPLICIT read-only vs\n * read-write decision (there is no default). The app never sees the list; it\n * resolves with the single granted mount, or rejects with a {@link SpaceError}\n * (`cancelled`) if declined. The granted scope is enforced host-side: the mount\n * is chroot'd to the project folder and `ro`-limited accordingly, so paths\n * outside the project are unnameable and writes on a `ro` grant fail `EROFS`.\n *\n * A project folder is the macOS-bundle-like unit an app works in inside a space;\n * the host records which app a folder belongs to (a `.immediately.run/` sidecar),\n * so the picker can surface the app's own projects or let the user create a new\n * one. Observe the granted access via {@link SandboxMount.mode}.\n *\n * Backend-general (§3.5): the picker offers whatever mounts the user has (today,\n * their spaces). Returns the granted mount by its universal id.\n */\nexport const requestMount = (): Promise<SandboxMount> => requestMountInternal('request', {});\n\n/** Prompt the user to grant a mount, returning the granted {@link SandboxMount}.\n *  @deprecated renamed to {@link requestMount} (backend-general, §3.5). */\nexport const requestSpace = requestMount;\n\n// ── content references (plan 12 §E / FILE_SHARING §7) ────────────────────────\n\n/**\n * Build a persisted CONTENT REFERENCE to a file in a mount — a `{mountId, relPath}`\n * pointer your app serializes into ITS OWN content (a board's JSON, an MDX file's\n * frontmatter, an album manifest — the platform doesn't dictate the container) so a\n * later viewer can resolve it. It is exactly the §5.7 {@link capFile} shape: ONE\n * capability, two delivery modes — runtime delegation (a task param, authorized by\n * the caller) vs a durable reference (authorized per-viewer by {@link resolveContentRef}).\n * `relPath` is BACKEND-NATURAL, so the reference resolves to the SAME path for every\n * viewer. Cross-app/cross-project references default to `ro`.\n *\n *   const ref = makeContentRef({ mountId: 'space:ACME', relPath: 'office-seating/desk.mdx' }, { mode: 'ro' });\n */\nexport const makeContentRef = (ref: { mountId: string; relPath: string }, opts: { mode: 'ro' | 'rw' }): FileCap => ({\n  $cap: 'file',\n  mountId: ref.mountId,\n  relPath: ref.relPath,\n  mode: opts.mode,\n});\n\n/**\n * Resolve a content reference your app found in content it ALREADY holds\n * (FILE_SHARING §7 / UI_AS_APPS §8.7; \"plan 12 §E\"). This is a RELAY, not a\n * fabrication: the host honors it ONLY when your app\n * already holds a grant to `ref.mountId` (else `forbidden`) — apps follow\n * writer-authored links inside granted content; they cannot name a space from\n * nothing (T27). The host runs a per-VIEWER consent prompt (named via the owning\n * app's project sidecar), and existence is never leaked — a decline and a\n * non-existent path are indistinguishable.\n *\n * On allow, the host APPENDS a read scope for the referenced path to your grant\n * (durable; same §8.15 lifecycle) and returns the STABLE absolute `path` the file\n * is mounted at — identical for every viewer, so a path the author stored resolves\n * the same for you. Read it through the `fs` module at that path. Rejects with a\n * {@link SpaceError}: `forbidden` (you don't hold the referenced mount) or\n * `cancelled` (the viewer declined / the path doesn't exist — no oracle).\n *\n *   const { path } = await resolveContentRef(ref);\n *   const text = await fs.promises.readFile(path, 'utf8');\n */\nexport const resolveContentRef = async (ref: FileCap): Promise<{ path: string }> => {\n  const path = await request<string>('resolveRef', { ref });\n  return { path };\n};\n\n/**\n * Resolve a BATCH of content references in ONE consent round (FILE_SHARING §7 /\n * UI_AS_APPS §8.7; \"plan 12 §E\"). When a\n * board opens with several embedded references, pass them all here: the host\n * coalesces them into a SINGLE consent prompt listing every target, instead of one\n * prompt per reference. Same relay gate and per-viewer semantics as\n * {@link resolveContentRef} (each ref's mount must already be held), applied to the\n * whole set — it is all-or-nothing: the user allows the batch or declines it.\n *\n * Resolves `{ paths }` with the STABLE absolute path of each ref, in input order.\n * Rejects with a {@link SpaceError}: `forbidden` (a referenced mount isn't held) or\n * `cancelled` (the viewer declined).\n *\n *   const { paths } = await resolveContentRefs(board.references);\n */\nexport const resolveContentRefs = async (refs: FileCap[]): Promise<{ paths: string[] }> => {\n  const paths = await request<string[]>('resolveRefs', { refs });\n  return { paths };\n};\n\n// ---------------------------------------------------------------------------\n// Settings — the per-user \"~/.config\"-style space (UI_AS_APPS_SPEC §3.3/§3.5/§8.2).\n// Each app gets its OWN settings subdir, auto-provisioned and chroot'd by the host\n// (no dialog, no powerbox). Read/write it through the returned mount's filesystem\n// port — there is deliberately no key/value get/set API; settings are just files.\n// ---------------------------------------------------------------------------\n\n// Issue a `protocol-settings` request, unwrapping {ok,data} and throwing a typed\n// SpaceError on failure (mirrors `request` for the spaces surface).\nconst settingsRequest = async <T = unknown>(method: string, query: Record<string, unknown> = {}): Promise<T> => {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_SETTINGS], method, [query])) as SpaceResult;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'settings request failed') as SpaceError;\n    err.code = (res?.code as SpaceError['code']) ?? 'unknown';\n    throw err;\n  }\n  return res.data as T;\n};\n\n/**\n * Mount this app's per-user settings — a private `~/.config`-style filesystem,\n * auto-provisioned for the signed-in user and isolated to THIS app (the host\n * chroots it; a different app can never name it). Read/write config files through\n * the returned mount. Rejects with a {@link SpaceError} (`auth-required`) when\n * signed out. Capability: baseline `settings:app`.\n *\n * **Which filesystem you get, and when that can change** (R3-413): for an\n * ordinary app — including one holding space grants, powerbox-picked or\n * declared — this is ALWAYS the app-level store (same mount id every call, so\n * \"which space did I pick\" style state survives later grants; no need to open\n * early and keep the handle). The one exception: an instance the host has\n * **floored** below its app tier (the generic-viewer containment,\n * `TRUST_MODES_SPEC` §5) gets a per-origin partition instead — a DIFFERENT\n * filesystem, chosen by the host, that changes when the loaded origin changes\n * and refuses (`forbidden`) when the floor forbids the write. If your app can\n * run floored and needs continuity across origins, keep state per-mount (the\n * returned `SandboxMount.id` tells you which partition you are in).\n */\nexport const openSettings = async (): Promise<SandboxMount> => {\n  const mount = await settingsRequest<SandboxMount>('open');\n  // The host has already accepted the request and announced the mount, so this\n  // normally resolves on the initial replay. Bounded anyway: an unbounded wait\n  // here turns any delivery failure into a promise that never settles, and every\n  // caller of `openSettings()` is doing it to reach durable state — so the app\n  // just quietly loses that state with nothing to report.\n  return waitForMount({ id: mount.id ?? mount.path }, SETTINGS_MOUNT_TIMEOUT_MS);\n};\n\n/** How long `openSettings()` waits for the host to deliver the mount it just\n *  agreed to create. Generous — this is a hang-breaker, not a latency budget. */\nconst SETTINGS_MOUNT_TIMEOUT_MS = 15_000;\n\n/**\n * One-time SEED of this app's settings from the parent it declares as `forkOf`\n * (its `package.json` `immediately.run.forkOf`) — so a fork inherits your\n * preferences from the original app (UI_AS_APPS_SPEC §3.4). The host asks the user\n * to confirm (a full consent when the apps have different owners, a light confirm\n * when the same owner publishes both) and copies the parent's settings into this\n * app's own subdir, skipping any file you already have. Non-throwing: resolves\n * `{ ok:false, code }` on decline (`cancelled`), no declared parent (`forbidden`),\n * or signed-out (`auth-required`). After `{ ok:true }`, read {@link openSettings}.\n * Capability: baseline `settings:fork`.\n */\nexport const importSettingsFromParent = async (): Promise<\n  { ok: true; copied: number } | { ok: false; code: string }\n> => {\n  try {\n    const data = await settingsRequest<{ copied: number }>('importFromParent');\n    return { ok: true, copied: data.copied };\n  } catch (e) {\n    return { ok: false, code: (e as SpaceError).code ?? 'unknown' };\n  }\n};\n\n/**\n * Mount ANOTHER app's per-user settings by its `appKey` — the elevated \"file\n * commander\" surface. Rejects `forbidden` unless this app holds the first-party-\n * only `settings:all` capability. Most apps want {@link openSettings} instead.\n */\nexport const openSettingsOf = async (appKey: string): Promise<SandboxMount> => {\n  const mount = await settingsRequest<SandboxMount>('openOf', { appKey });\n  return waitForMount({ id: mount.id ?? mount.path });\n};\n\n/**\n * List every app that has per-user settings — the elevated \"file commander\"\n * enumeration. Pair with {@link openSettingsOf} to mount any of them. Rejects\n * `forbidden` unless this app holds the first-party-only `settings:all`.\n */\nexport const listSettingsApps = (): Promise<string[]> => settingsRequest<string[]>('list');\n\n/** Create a brand-new, empty platform-hosted space, granted to THIS app in full\n *  (read-write) — the user's create consent is consent for the app to create\n *  storage for itself, and the host records the same durable grant the\n *  {@link requestMount} powerbox would. So the returned mount can be re-opened\n *  later with {@link mountSpace} / {@link mount} (`space:<id>`) with no prompt —\n *  on the next load, in another tab, after sign-out/sign-in — until the user\n *  revokes the grant in their grants surface, after which `mount` answers\n *  `forbidden`. Other apps get nothing: they still reach the space only through\n *  the powerbox. (Before site-main R3-406 no grant was recorded and the space\n *  could only be re-found via the powerbox.) */\nexport const createSpace = (opts: { name?: string } = {}): Promise<SandboxMount> =>\n  requestMountInternal('create', opts);\n\n/** Release a mounted space (stops its listener on the host). */\nexport const unmountSpace = async (query: { spaceId: string }): Promise<void> => {\n  await request('unmount', query);\n};\n\n// ---------------------------------------------------------------------------\n// Space management (the space-manager app) — UI_AS_APPS_SPEC §5.2. These are\n// ELEVATED: enumerating all the user's spaces is `spaces:user`; mutating\n// membership (share/unshare/setRole) and resolving handles is `spaces:admin`.\n// The host enforces the owner-lockout invariant (a space always keeps an owner,\n// T41) and rate-limits handle lookups (L1); the OAuth/identity token never\n// crosses to the app.\n// ---------------------------------------------------------------------------\n\n/** A pending invitation to a space (pull-based sharing, FILE_SHARING_SPEC §6.4).\n *  It grants NO access until accepted — the recipient accepts it from their inbox\n *  ({@link listMyInvites} → {@link acceptInvite}), materializing membership. The\n *  display fields (`name`/`login`/`avatarUrl`) are untrusted for rendering. */\nexport interface Invite {\n  spaceId: string;\n  /** The invitee's uid — carried so the owner's pending list can\n   *  {@link revokeInvite}(spaceId, uid). */\n  uid: string;\n  role: Role;\n  owner: string;\n  name?: string;\n  invitedBy: string;\n  /** epoch ms (server-stamped); absent until the write settles. */\n  invitedAt?: number;\n  login?: string;\n  avatarUrl?: string;\n}\n\n/** The owner's outstanding invitations for a space — `spaces:admin`. */\nexport const listPendingInvites = (spaceId: string): Promise<Invite[]> =>\n  request<Invite[]>('pendingInvites', { spaceId });\n\n/** Withdraw a pending invitation (distinct from {@link unshareSpace}, which removes\n *  an ACCEPTED member) — `spaces:admin`. */\nexport const revokeInvite = async (spaceId: string, uid: string): Promise<void> => {\n  await request('revokeInvite', { spaceId, uid });\n};\n\n/** The caller's OWN invitation inbox — `spaces:user`. */\nexport const listMyInvites = (): Promise<Invite[]> => request<Invite[]>('listInvites', {});\n\n/** Accept an invitation: materialize your membership at the invited role and clear\n *  the invite — `spaces:user`. An invitation the caller doesn't hold rejects with\n *  `forbidden` (indistinguishable from a nonexistent space; no existence oracle). */\nexport const acceptInvite = async (spaceId: string): Promise<void> => {\n  await request('acceptInvite', { spaceId });\n};\n\n/** Decline (dismiss) an invitation from your inbox; writes no membership —\n *  `spaces:user`. */\nexport const declineInvite = async (spaceId: string): Promise<void> => {\n  await request('declineInvite', { spaceId });\n};\n\n// The live invitations inbox (FILE_SHARING §6.4/§9.8): the host pushes the caller's\n// current invitations on change and replays on register-frame; gated `spaces:user`.\n// So an invite that arrives (or an accepted/declined one leaving) reflects within one\n// snapshot — no poll. Mirrors the host's `invitations`/`request-invitations` wiring.\nconst invitesChannel = createPushChannel<Invite[]>({\n  pushType: INVITATIONS,\n  requestType: REQUEST_INVITATIONS,\n  initial: [],\n  parse: (msg) => (Array.isArray(msg.invites) ? (msg.invites as Invite[]) : undefined),\n});\n\n/** The caller's current invitations (`spaces:user`). One-off read; use\n *  {@link onInvitesChange}/{@link useInvites} to react live. */\nexport const getInvites = (): Invite[] => invitesChannel.get();\n\n/** Subscribe to invitation-inbox changes (arrived / accepted / declined). Invoked\n *  immediately with the current list, then on every change. Returns an unsubscribe. */\nexport const onInvitesChange = (listener: (invites: Invite[]) => void): (() => void) =>\n  invitesChannel.onChange(listener);\n\n/** React hook returning the caller's live invitation inbox, re-rendering on change\n *  (the space-manager Invitations inbox, §9.8). */\nexport const useInvites = (): Invite[] => invitesChannel.use();\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAAyB;AAEzB,mBAAoC;AACpC,0BAA0D;AAC1D,yBAAkC;AAClC,yBAA+B;AAC/B,wBAA6B;AAY7B,oBAUO;AAIP,sBAUO;AACP,6BAAwB;AAUjB,MAAM,kBAAkB,UAAc,mCAAe,GAAG,gBAAgB;AA6E/E,MAAM,WAAW,CAAC,MAA4B,EAAE,MAAM,EAAE;AAExD,MAAM,uBAA4C,oBAAI,IAAuB;AAAA,EAC3E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,MAAM,sBAAsB,CAAC,UAC3B,OAAO,UAAU,YAAY,qBAAqB,IAAI,KAAK,IAAK,QAA8B;AAWhG,MAAM,uBAAuB,MAA2B;AACtD,MAAI;AAEF,UAAM,MAAM,QAAQ,YAAY,QAAQ,SAAS;AACjD,WAAO,OAAO,OAAO,IAAI,cAAc,aAAa,MAAM;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,IAAI,eAAoC;AAExC,MAAM,wBAAwB,MAAoB;AAChD,MAAI,aAAc,QAAO;AACzB,MAAI,SAAyB,CAAC;AAC9B,QAAM,YAAY,oBAAI,IAAoD;AAC1E,QAAM,OAAO,CAAC,YAA4B;AACxC,eAAW,KAAK,CAAC,GAAG,SAAS,EAAG,GAAE,QAAQ,OAAO;AAAA,EACnD;AAEA,uCAAY,2BAAW,CAAC,QAA6B;AACnD,UAAMA,SAAkC,IAAI;AAC5C,QAAI,CAACA,OAAO;AACZ,UAAM,MAAM,SAASA,MAAK;AAC1B,aAAS,CAAC,GAAG,OAAO,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,GAAG,GAAGA,MAAK;AAC7D,SAAK,CAAC,CAAC;AAAA,EACT,CAAC;AACD,uCAAY,8BAAc,CAAC,QAA6B;AACtD,UAAM,MAA0B,IAAI,MAAM,IAAI;AAC9C,QAAI,OAAO,KAAM;AACjB,UAAM,SAAS,oBAAoB,IAAI,MAAM;AAC7C,UAAM,UAAU,OAAO,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,EAAE;AACvF,QAAI,QAAQ,WAAW,EAAG;AAC1B,aAAS,OAAO,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,GAAG;AACjD,SAAK,OAAO;AAAA,EACd,CAAC;AAID,MAAI;AACF,yCAAY,8BAAc;AAAA,EAC5B,QAAQ;AAAA,EAER;AAEA,iBAAe;AAAA,IACb,WAAW,MAAM;AAAA,IACjB,UAAU,CAAC,aAAa;AACtB,gBAAU,IAAI,QAAQ;AACtB,eAAS,QAAQ,CAAC,CAAC;AACnB,aAAO,EAAE,SAAS,MAAM,UAAU,OAAO,QAAQ,EAAE;AAAA,IACrD;AAAA,EACF;AACA,SAAO;AACT;AAIA,MAAM,eAAe,MAAoB,qBAAqB,KAAK,sBAAsB;AAMzF,MAAM,UAAU,CAACA,QAAqB,cAA+B,gCAAaA,QAAO,KAAK;AASvF,MAAM,YAAY,MAAsB,aAAa,EAAE,UAAU;AAGjE,MAAM,YAAY,CAAC,UAAgD,UAAU,EAAE,KAAK,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAU5G,MAAM,iBAAiB,CAAC,aAAsF;AACnH,QAAM,aAAa,aAAa,EAAE,SAAS,QAAQ;AACnD,SAAO,MAAM,WAAW,QAAQ;AAClC;AAyBO,MAAM,eAAe,CAAC,OAAmB,cAC9C,mBAAmB,gBAAgB,OAAO,SAAS;AAI9C,MAAM,qBAAqB,CAChC,WACA,OACA,cAEA,IAAI,QAAQ,CAAC,SAAS,WAAW;AAK/B,MAAI;AACJ,MAAI,UAAU;AACd,MAAI;AAGJ,QAAM,OAAO,MAAY;AACvB,cAAU;AACV,QAAI,UAAU,OAAW,cAAa,KAAK;AAC3C,SAAK,QAAQ,QAAQ,EAAE,KAAK,MAAM,cAAc,CAAC;AAAA,EACnD;AACA,gBAAc,UAAU,CAAC,WAAW;AAClC,QAAI,QAAS;AACb,UAAM,QAAQ,OAAO,KAAK,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAClD,QAAI,OAAO;AACT,WAAK;AACL,cAAQ,KAAK;AAAA,IACf;AAAA,EACF,CAAC;AAGD,MAAI,CAAC,WAAW,cAAc,QAAW;AACvC,YAAQ,WAAW,MAAM;AACvB,UAAI,QAAS;AACb,WAAK;AACL,YAAM,MAAM,IAAI;AAAA,QACd,gCAAgC,SAAS,kBAAkB,KAAK,UAAU,KAAK,CAAC;AAAA,MAClF;AACA,UAAI,OAAO;AACX,aAAO,GAAG;AAAA,IACZ,GAAG,SAAS;AAAA,EACd;AACF,CAAC;AAGI,MAAM,YAAY,MAAsB;AAC7C,QAAM,CAAC,QAAQ,SAAS,QAAI,uBAAyB,SAAS;AAC9D,8BAAU,MAAM,eAAe,SAAS,GAAG,CAAC,CAAC;AAC7C,SAAO;AACT;AAsBA,MAAM,2BAAuB,sCAAkC;AAAA,EAC7D,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,CAAC;AAAA,EACV,OAAO,CAAC,QAAS,MAAM,QAAQ,IAAI,MAAM,IAAK,IAAI,SAA4B;AAChF,CAAC;AAKM,MAAM,mBAAmB,MAAsB,qBAAqB,IAAI;AAKxE,MAAM,wBAAwB,CAAC,aACpC,qBAAqB,SAAS,QAAQ;AAKjC,MAAM,mBAAmB,MAAsB,qBAAqB,IAAI;AA0B/E,MAAM,UAAU,OAAoB,QAAgB,QAAiC,CAAC,MAAkB;AACtG,QAAM,MAAO,UAAM,qCAAgB,+BAAQ,+BAAe,GAAG,QAAQ,CAAC,KAAK,CAAC;AAC5E,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,sBAAsB;AAC5D,QAAI,OAAQ,KAAK,QAA+B;AAChD,UAAM;AAAA,EACR;AACA,SAAO,IAAI;AACb;AAKA,MAAM,uBAAuB,OAAO,QAAgB,UAA0D;AAC5G,QAAMA,SAAQ,MAAM,QAAsB,QAAQ,KAAK;AACvD,SAAO,aAAa,EAAE,IAAIA,OAAM,MAAMA,OAAM,KAAK,CAAC;AACpD;AAQO,MAAM,QAAQ,CAAC,YAA2C,qBAAqB,SAAS,EAAE,OAAO,QAAQ,CAAC;AAI1G,MAAM,aAAa,CAAC,UAAsD,MAAM,SAAS,MAAM,OAAO,EAAE;AAqBxG,MAAM,eAAe,MAA6B,qBAAqB,WAAW,CAAC,CAAC;AAIpF,MAAM,eAAe;AAgBrB,MAAM,iBAAiB,CAAC,KAA2C,UAA0C;AAAA,EAClH,MAAM;AAAA,EACN,SAAS,IAAI;AAAA,EACb,SAAS,IAAI;AAAA,EACb,MAAM,KAAK;AACb;AAsBO,MAAM,oBAAoB,OAAO,QAA4C;AAClF,QAAM,OAAO,MAAM,QAAgB,cAAc,EAAE,IAAI,CAAC;AACxD,SAAO,EAAE,KAAK;AAChB;AAiBO,MAAM,qBAAqB,OAAO,SAAkD;AACzF,QAAM,QAAQ,MAAM,QAAkB,eAAe,EAAE,KAAK,CAAC;AAC7D,SAAO,EAAE,MAAM;AACjB;AAWA,MAAM,kBAAkB,OAAoB,QAAgB,QAAiC,CAAC,MAAkB;AAC9G,QAAM,MAAO,UAAM,qCAAgB,+BAAQ,iCAAiB,GAAG,QAAQ,CAAC,KAAK,CAAC;AAC9E,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,yBAAyB;AAC/D,QAAI,OAAQ,KAAK,QAA+B;AAChD,UAAM;AAAA,EACR;AACA,SAAO,IAAI;AACb;AAqBO,MAAM,eAAe,YAAmC;AAC7D,QAAMA,SAAQ,MAAM,gBAA8B,MAAM;AAMxD,SAAO,aAAa,EAAE,IAAIA,OAAM,MAAMA,OAAM,KAAK,GAAG,yBAAyB;AAC/E;AAIA,MAAM,4BAA4B;AAa3B,MAAM,2BAA2B,YAEnC;AACH,MAAI;AACF,UAAM,OAAO,MAAM,gBAAoC,kBAAkB;AACzE,WAAO,EAAE,IAAI,MAAM,QAAQ,KAAK,OAAO;AAAA,EACzC,SAAS,GAAG;AACV,WAAO,EAAE,IAAI,OAAO,MAAO,EAAiB,QAAQ,UAAU;AAAA,EAChE;AACF;AAOO,MAAM,iBAAiB,OAAO,WAA0C;AAC7E,QAAMA,SAAQ,MAAM,gBAA8B,UAAU,EAAE,OAAO,CAAC;AACtE,SAAO,aAAa,EAAE,IAAIA,OAAM,MAAMA,OAAM,KAAK,CAAC;AACpD;AAOO,MAAM,mBAAmB,MAAyB,gBAA0B,MAAM;AAYlF,MAAM,cAAc,CAAC,OAA0B,CAAC,MACrD,qBAAqB,UAAU,IAAI;AAG9B,MAAM,eAAe,OAAO,UAA8C;AAC/E,QAAM,QAAQ,WAAW,KAAK;AAChC;AA+BO,MAAM,qBAAqB,CAAC,YACjC,QAAkB,kBAAkB,EAAE,QAAQ,CAAC;AAI1C,MAAM,eAAe,OAAO,SAAiB,QAA+B;AACjF,QAAM,QAAQ,gBAAgB,EAAE,SAAS,IAAI,CAAC;AAChD;AAGO,MAAM,gBAAgB,MAAyB,QAAkB,eAAe,CAAC,CAAC;AAKlF,MAAM,eAAe,OAAO,YAAmC;AACpE,QAAM,QAAQ,gBAAgB,EAAE,QAAQ,CAAC;AAC3C;AAIO,MAAM,gBAAgB,OAAO,YAAmC;AACrE,QAAM,QAAQ,iBAAiB,EAAE,QAAQ,CAAC;AAC5C;AAMA,MAAM,qBAAiB,sCAA4B;AAAA,EACjD,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,CAAC;AAAA,EACV,OAAO,CAAC,QAAS,MAAM,QAAQ,IAAI,OAAO,IAAK,IAAI,UAAuB;AAC5E,CAAC;AAIM,MAAM,aAAa,MAAgB,eAAe,IAAI;AAItD,MAAM,kBAAkB,CAAC,aAC9B,eAAe,SAAS,QAAQ;AAI3B,MAAM,aAAa,MAAgB,eAAe,IAAI;","names":["mount"]}
+{"version":3,"sources":["../src/mounts.ts"],"sourcesContent":["import { APP_ROOT } from '@immediately-run/platform-constants';\n\nimport { useEffect, useState } from 'react';\nimport { protocolRequest, sendMessage, addListener } from './sandboxUtils';\nimport { createPushChannel } from './pushChannel';\nimport { getHostRuntime } from './hostRuntime';\nimport { mountMatches } from './mountMatch';\n// R3-166 — the `spaces:*` family is GENERATED from the capability descriptor set\n// (`scripts/codegen-prototype/descriptors.spaces.mjs`) rather than hand-written here.\n// Re-exported from this module so every existing import path keeps working: the\n// swap is a no-op to consumers (SDK_SIMPLIFICATION_SPEC §7 step 3), which is\n// asserted by the emitted-`.d.ts` before/after comparison, not assumed.\n//\n// `Role` is imported (not only re-exported) because `Invite` below still uses it —\n// the invite methods are the same `spaces:` scheme but are NOT yet described, so\n// they remain hand-written. That split is the next migration increment.\nimport type { Role } from './generated/spaces';\nexport type { Role, SpaceInfo, Member, ResolvedUser, GrantRecord } from './generated/spaces';\nexport {\n  listSpaces,\n  listAllSpaces,\n  getSpaceMembers,\n  inviteToSpace,\n  unshareSpace,\n  setSpaceRole,\n  lookupUser,\n  listGrants,\n  revokeGrant,\n} from './generated/spaces';\n// Type-only: `tasks.ts` registers a host listener at module load, so we reuse the\n// FileCap SHAPE without pulling that side effect into every `mounts` importer.\nimport type { FileCap } from './tasks';\nimport {\n  INVITATIONS,\n  MOUNT_ADD,\n  MOUNT_REMOVE,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  REQUEST_INVITATIONS,\n  REQUEST_MOUNTS,\n  REQUEST_SESSION_MOUNTS,\n  SESSION_MOUNTS,\n} from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/**\n * The absolute path where this app's own repository filesystem is mounted\n * (FILE_SHARING_SPEC §11.2). Prefer this over hardcoding `/app`: the repo is\n * dual-mounted at both `/app` (back-compat) and its canonical `/mnt/{hash}`\n * address, and this returns the canonical one the host reports. Falls back to\n * `/app` when the host hasn't reported a canonical path (older host / before the\n * report arrives) — both paths are live, so either resolves the same files.\n */\nexport const getAppMountPath = (): string => getHostRuntime()?.appMountPath ?? APP_ROOT;\n\n/**\n * A filesystem mount available to the sandbox, mirrored from the host window.\n *\n * Mounts appear on demand — call {@link openSettings} for this app's own settings,\n * or {@link mountSpace} / {@link requestMount} to mount a Firestore-backed \"space\".\n * Read or subscribe to the set, then access the files through the `fs` module at\n * the mount's `path`.\n */\nexport interface SandboxMount {\n  /** Absolute path where the mount is reachable (e.g. `/spaces/{id}`). */\n  path: string;\n  /** Backend kind, e.g. `'firestore'`. */\n  type: string;\n  /** Optional stable identifier (the spaceId, for spaces). */\n  id?: string;\n  /**\n   * Access mode of the granted view: `'rw'` (read-write) or `'ro'` (read-only).\n   * A live role downgrade re-announces the same mount with `mode: 'ro'`; apps\n   * observing `onMountsChange` see the change and writes start failing `EROFS`.\n   * Absent on the primary repo mount (treated as read-write).\n   */\n  mode?: 'ro' | 'rw';\n  /**\n   * Human-readable label for the mount — the space's display name, or the repo\n   * label for the primary working-tree mount (R3-69). Use this to show users and\n   * agents *what* a mount is: the `path` (`/mnt/{hash}`) and `id` (the spaceId)\n   * are opaque, and space names are not unique, so neither alone tells you which\n   * filesystem you're looking at. Absent when the host can't resolve a name\n   * (older host, or a name it never learned) — fall back to `id`/`path`.\n   */\n  name?: string;\n  /**\n   * The granted scopes of this mount (plan 12 §8.7 / §F): each `{subtree, mode}`\n   * is a path prefix you hold and at what access, at the mount's backend-natural\n   * paths. Use it to reason about per-path writability — which subtree is `rw` —\n   * WITHOUT probing `EROFS`. A single whole-mount grant is `[{ subtree: '/', mode }]`.\n   * Absent on the primary repo mount and on an older host that doesn't report it.\n   */\n  rules?: MountRule[];\n}\n\n/** One granted scope of a mount (plan 12 §F): a backend-natural path prefix and\n *  the access mode there. The most specific (longest) matching rule governs a path. */\nexport interface MountRule {\n  subtree: string;\n  mode: 'ro' | 'rw';\n}\n\n/**\n * Why a mounted filesystem was removed, surfaced on the removed descriptor so an\n * app can say *why* it vanished instead of failing mutely (auth-mount §\"mount-remove\"\n * / AM2-4):\n * - `revoked` — a durable grant was revoked (revokeGrant / consent withdrawal);\n * - `unshared` — the granting user's membership was removed (or downgraded out);\n * - `signed-out` — sign-out tore down every mount;\n * - `unmounted` — the app's own `unmountSpace` (or region teardown);\n * - `deleted` — the space was soft-deleted.\n * An older host that sends no reason is read as `'revoked'` (most conservative).\n */\nexport type MountRemoveReason = 'revoked' | 'unshared' | 'signed-out' | 'unmounted' | 'deleted';\n\n/** A descriptor delivered as REMOVED to a mounts-change listener: the mount that\n *  went away, plus the `reason` it did. */\nexport interface RemovedMount extends SandboxMount {\n  reason: MountRemoveReason;\n}\n\ninterface MountService {\n  getMounts(): SandboxMount[];\n  onChange(listener: (mounts: SandboxMount[], removed: RemovedMount[]) => void): { dispose(): void };\n}\n\n// The stable key of a mount: its `id` (spaceId) when present, else its `path`.\n// Matches the sandbox `MountService.mountKey` so add/replace/remove agree on both\n// sides of the wire (a role downgrade re-announces the SAME key with `mode: 'ro'`).\nconst mountKey = (m: SandboxMount): string => m.id ?? m.path;\n\nconst MOUNT_REMOVE_REASONS: ReadonlySet<string> = new Set<MountRemoveReason>([\n  'revoked',\n  'unshared',\n  'signed-out',\n  'unmounted',\n  'deleted',\n]);\n\n// Normalize an over-the-wire `mount-remove` reason; an absent/unknown value (older\n// host) reads as `'revoked'`, the most conservative reading (mirrors the sandbox).\nconst asMountRemoveReason = (value: unknown): MountRemoveReason =>\n  typeof value === 'string' && MOUNT_REMOVE_REASONS.has(value) ? (value as MountRemoveReason) : 'revoked';\n\n// The injected sandbox-bundler mount service (`module.evaluation.module.bundler.mounts`),\n// or null when the SDK is npm-fetched with no injection — same dual-mode shape as\n// `sandboxUtils.transport()` and the metadata emitter (SDK_PACKAGING_SPEC §4/§8).\n/** @deprecated-path The injected `bundler.mounts` read — window opened 2026-08-25\n *  (R3-278). The protocol equivalent is `transportMountService()` below (the\n *  `mount-add`/`mount-remove` mirror + `request-mounts` replay), which the dual-mode\n *  chooser already falls back to. Injection stays preferred for byte-compat through\n *  the window; see DEPRECATION_CANDIDATES.md.\n */\nconst injectedMountService = (): MountService | null => {\n  try {\n    // @ts-ignore - injected by the sandbox runtime\n    const svc = module?.evaluation?.module?.bundler?.mounts;\n    return svc && typeof svc.getMounts === 'function' ? svc : null;\n  } catch {\n    return null;\n  }\n};\n\n// Transport-backed descriptor cache (R3-51b): the npm-fetched fallback that builds\n// the same `getMounts()`/`onChange()` view the injected `bundler.mounts` provides,\n// directly from the host's `mount-add`/`mount-remove` messages over the §4 transport.\n// The host already posts these (it's how the in-iframe bundler service is populated);\n// the `MessagePort` a `mount-add` transfers is consumed by the sandbox runtime to wire\n// ZenFS and is irrelevant here — the SDK only mirrors the *descriptors*. A lazy\n// singleton so `getMounts`/`onMountsChange` share one cache, one subscription, and one\n// `request-mounts` replay (the host re-announces every current mount, like a poll).\nlet transportSvc: MountService | null = null;\n\nconst transportMountService = (): MountService => {\n  if (transportSvc) return transportSvc;\n  let mounts: SandboxMount[] = [];\n  const listeners = new Set<(m: SandboxMount[], r: RemovedMount[]) => void>();\n  const fire = (removed: RemovedMount[]) => {\n    for (const l of [...listeners]) l(mounts, removed);\n  };\n\n  addListener(MOUNT_ADD, (msg: Record<string, any>) => {\n    const mount: SandboxMount | undefined = msg.mount;\n    if (!mount) return;\n    const key = mountKey(mount);\n    mounts = [...mounts.filter((m) => mountKey(m) !== key), mount];\n    fire([]);\n  });\n  addListener(MOUNT_REMOVE, (msg: Record<string, any>) => {\n    const key: string | undefined = msg.id ?? msg.path;\n    if (key == null) return;\n    const reason = asMountRemoveReason(msg.reason);\n    const removed = mounts.filter((m) => mountKey(m) === key).map((m) => ({ ...m, reason }));\n    if (removed.length === 0) return;\n    mounts = mounts.filter((m) => mountKey(m) !== key);\n    fire(removed);\n  });\n\n  // Ask the host to replay the current set (the matching `mount-add`s may have been\n  // sent before this SDK subscribed). Best-effort: a transport not yet ready throws.\n  try {\n    sendMessage(REQUEST_MOUNTS);\n  } catch {\n    /* transport not ready — the live mount-add stream still populates the cache */\n  }\n\n  transportSvc = {\n    getMounts: () => mounts,\n    onChange: (listener) => {\n      listeners.add(listener);\n      listener(mounts, []); // immediate replay to the new subscriber\n      return { dispose: () => listeners.delete(listener) };\n    },\n  };\n  return transportSvc;\n};\n\n// Phase-5 dual mode: prefer the injected bundler service (the live path, behaviour\n// byte-for-byte unchanged); fall back to the transport-built cache when npm-fetched.\nconst mountService = (): MountService => injectedMountService() ?? transportMountService();\n\n/** A predicate-style matcher for {@link findMount} / {@link waitForMount}. Any\n *  combination of coordinates; `name` matches the human-readable mount label. */\nexport type MountQuery = { type?: string; id?: string; path?: string; name?: string };\n\nconst matches = (mount: SandboxMount, query: MountQuery): boolean => mountMatches(mount, query);\n\n/**\n * Returns the mounts currently available. Poll this whenever you need a one-off\n * read; use {@link onMountsChange} or {@link useMounts} to react to changes.\n * Each descriptor carries its `id` (the spaceId), `path` (`/mnt/{hash}`) and —\n * when the host can resolve it — a human-readable `name` (R3-69), so this doubles\n * as a queryable mount→space mapping for showing or locating a mount by name.\n */\nexport const getMounts = (): SandboxMount[] => mountService().getMounts();\n\n/** Returns the first mount matching `query`, or `undefined`. */\nexport const findMount = (query: MountQuery): SandboxMount | undefined => getMounts().find((m) => matches(m, query));\n\n/**\n * Subscribe to mount changes. The listener is invoked immediately with the\n * current mounts (and an empty `removed`), then again on every change. The second\n * argument carries the descriptors REMOVED by that change, each with its `reason`\n * (AM2-4) — so an app can react to *why* a mount vanished (e.g. tell the user a\n * shared space was `unshared` vs `deleted`). It is empty on adds and on the\n * initial replay. Returns an unsubscribe fn.\n */\nexport const onMountsChange = (listener: (mounts: SandboxMount[], removed: RemovedMount[]) => void): (() => void) => {\n  const disposable = mountService().onChange(listener);\n  return () => disposable.dispose();\n};\n\n/**\n * Resolves once a mount matching `query` is present (immediately if it already\n * is). Handy for \"use it when it appears\" — e.g.\n * `await waitForMount({ type: 'firestore' })` before reading `/firestore`.\n *\n * `timeoutMs` (optional, additive) rejects with a `timeout`-coded error instead of\n * waiting forever. Omit it to keep the original unbounded behaviour — but prefer\n * setting it on any path whose caller would otherwise hang silently: a mount that\n * never arrives is indistinguishable from one that is merely slow, and an awaited\n * promise that never settles surfaces to the user as a feature that quietly does\n * nothing.\n *\n * **Hazard — `onMountsChange` calls its listener SYNCHRONOUSLY on subscribe** (the\n * documented initial replay). So when the mount is already present — the common\n * case, since callers typically `await` the host request that creates it first —\n * the callback below runs *during* the `onMountsChange(...)` call, before the\n * assignment to `unsubscribe` completes. `unsubscribe` is therefore declared with\n * `let` ABOVE the subscription and read only inside a deferred closure: writing\n * `const unsubscribe = onMountsChange(...)` and referencing it in the callback\n * throws `ReferenceError: Cannot access 'unsubscribe' before initialization` (a\n * temporal-dead-zone read) on exactly that path. That bug silently broke\n * `openSettings()` — and with it the agent's conversation memory.\n */\nexport const waitForMount = (query: MountQuery, timeoutMs?: number): Promise<SandboxMount> =>\n  awaitMatchingMount(onMountsChange, query, timeoutMs);\n\n/** The framework-free core of {@link waitForMount}, with the subscription injected\n *  so a test can drive the synchronous-initial-replay case that broke it. */\nexport const awaitMatchingMount = (\n  subscribe: (listener: (mounts: SandboxMount[]) => void) => () => void,\n  query: MountQuery,\n  timeoutMs?: number,\n): Promise<SandboxMount> =>\n  new Promise((resolve, reject) => {\n    // `let`, declared BEFORE `subscribe(...)` — see the hazard note above. A\n    // `const` bound to the subscribe call is in its temporal dead zone while the\n    // synchronous initial replay runs, and any read of it from the listener\n    // throws.\n    let unsubscribe: (() => void) | undefined;\n    let settled = false;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    // Deferred so we never dispose the subscription from inside its own initial\n    // replay, and late enough that `unsubscribe` is always assigned.\n    const stop = (): void => {\n      settled = true;\n      if (timer !== undefined) clearTimeout(timer);\n      void Promise.resolve().then(() => unsubscribe?.());\n    };\n    unsubscribe = subscribe((mounts) => {\n      if (settled) return;\n      const found = mounts.find((m) => matches(m, query));\n      if (found) {\n        stop();\n        resolve(found);\n      }\n    });\n    // The initial replay may have settled us above, before `unsubscribe` existed;\n    // `stop()`'s deferred read picks it up, so nothing more is needed here.\n    if (!settled && timeoutMs !== undefined) {\n      timer = setTimeout(() => {\n        if (settled) return;\n        stop();\n        const err = new Error(\n          `waitForMount timed out after ${timeoutMs}ms waiting for ${JSON.stringify(query)}`,\n        ) as SpaceError;\n        err.code = 'timeout';\n        reject(err);\n      }, timeoutMs);\n    }\n  });\n\n/** React hook returning the mounts currently available, re-rendering on change. */\nexport const useMounts = (): SandboxMount[] => {\n  const [mounts, setMounts] = useState<SandboxMount[]>(getMounts);\n  useEffect(() => onMountsChange(setMounts), []);\n  return mounts;\n};\n\n// ---------------------------------------------------------------------------\n// Session-scope mounts — the first-party \"App | Session\" lens (PRINCIPALS §9 B2).\n// ---------------------------------------------------------------------------\n\n/** A mount as seen through the first-party **Session** lens (PRINCIPALS_SPEC §9 B2):\n *  the session's mounts BEYOND this app's own (the editor/agent session's). This is\n *  a metadata view — no filesystem port — so it extends {@link SandboxMount} with only\n *  {@link forwardedToApp}. */\nexport interface SessionMount extends SandboxMount {\n  /** True iff this mount is ALSO in the app's own {@link useMounts} (the App lens);\n   *  `false` for a session-export-only mount visible only to the editor/agent + the\n   *  Session lens. */\n  forwardedToApp: boolean;\n}\n\n// The host pushes the session mount list ONLY to a FIRST-PARTY frame — the channel\n// is gated by the first-party-only `mounts:registry` capability (§8.9.1 / D-PRIN-4).\n// A URL-loaded/previewed app (or a fork of the File Explorer) never holds it, so the\n// push never arrives and `initial: []` stands — the Session lens is simply absent,\n// fail-closed. Mirrors the host's `session-mounts`/`request-session-mounts` wiring.\nconst sessionMountsChannel = createPushChannel<SessionMount[]>({\n  pushType: SESSION_MOUNTS,\n  requestType: REQUEST_SESSION_MOUNTS,\n  initial: [],\n  parse: (msg) => (Array.isArray(msg.mounts) ? (msg.mounts as SessionMount[]) : undefined),\n});\n\n/** The session's mounts (the \"Session\" lens superset), or `[]` when this frame is\n *  not first-party. One-off read; use {@link onSessionMountsChange}/{@link useSessionMounts}\n *  to react live. First-party only (`mounts:registry`) — a fork always sees `[]`. */\nexport const getSessionMounts = (): SessionMount[] => sessionMountsChannel.get();\n\n/** Subscribe to Session-lens mount changes. Invoked immediately with the current\n *  list (`[]` for a non-first-party frame), then on every change. Returns an\n *  unsubscribe. */\nexport const onSessionMountsChange = (listener: (mounts: SessionMount[]) => void): (() => void) =>\n  sessionMountsChannel.onChange(listener);\n\n/** React hook returning the live \"Session\" lens mount list, re-rendering on change.\n *  Empty for any non-first-party frame (the host withholds the channel), so a URL-\n *  loaded File Explorer fork renders no Session lens. */\nexport const useSessionMounts = (): SessionMount[] => sessionMountsChannel.use();\n\n// ---------------------------------------------------------------------------\n// Spaces — on-demand, shareable Firestore-backed filesystems.\n// The host owns all UX: if you aren't signed in, or the space doesn't exist or\n// isn't accessible, the parent window presents sign-in / create / request-access\n// and only then resolves these calls. See docs/specs/FILE_SHARING_SPEC.md.\n// ---------------------------------------------------------------------------\n\n/** An error from a space operation, carrying a machine-readable `code`. */\nexport interface SpaceError extends Error {\n  code:\n    | 'auth-required'\n    | 'cancelled'\n    | 'forbidden'\n    | 'not-found'\n    | 'unsupported-scheme'\n    // Client-side, never from the host: a bounded `waitForMount` gave up.\n    | 'timeout'\n    | 'unknown';\n}\n\ntype SpaceResult = { ok: true; data: unknown } | { ok: false; code: string; message: string };\n\n// Issue a spaces protocol request, unwrapping the host's {ok,data} envelope and\n// throwing a typed SpaceError on failure.\nconst request = async <T = unknown>(method: string, query: Record<string, unknown> = {}): Promise<T> => {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_SPACES], method, [query])) as SpaceResult;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'space request failed') as SpaceError;\n    err.code = (res?.code as SpaceError['code']) ?? 'unknown';\n    throw err;\n  }\n  return res.data as T;\n};\n\n// Request a space mount, then wait until the host actually registers it. The\n// host announces the mount (`mount-add`) separately from the protocol reply, so\n// an immediate read could otherwise race the mount.\nconst requestMountInternal = async (method: string, query: Record<string, unknown>): Promise<SandboxMount> => {\n  const mount = await request<SandboxMount>(method, query);\n  return waitForMount({ id: mount.id ?? mount.path });\n};\n\n/**\n * Mount a filesystem by its **universal mount id** (UI_AS_APPS_SPEC §3.5) —\n * `scheme:locator`, e.g. `space:{spaceId}` or `github:owner/repo@ref`. Backend-blind:\n * the host resolves the scheme. A scheme with no resolver rejects with\n * {@link SpaceError} `unsupported-scheme`.\n */\nexport const mount = (mountId: string): Promise<SandboxMount> => requestMountInternal('mount', { mount: mountId });\n\n/** Mount a specific space by id (e.g. one shared with you, or from a link). A thin\n *  shim over {@link mount} with the `space:` scheme. */\nexport const mountSpace = (query: { spaceId: string }): Promise<SandboxMount> => mount(`space:${query.spaceId}`);\n\n/**\n * Ask the user to grant a filesystem to this app — the §8.6 powerbox. The app\n * asks; the HOST shows the user their spaces and, for the chosen one, its PROJECT\n * FOLDERS (§8.7). The user picks ONE project — so a shared space opens scoped to\n * just that project, never the whole space — and makes an EXPLICIT read-only vs\n * read-write decision (there is no default). The app never sees the list; it\n * resolves with the single granted mount, or rejects with a {@link SpaceError}\n * (`cancelled`) if declined. The granted scope is enforced host-side: the mount\n * is chroot'd to the project folder and `ro`-limited accordingly, so paths\n * outside the project are unnameable and writes on a `ro` grant fail `EROFS`.\n *\n * A project folder is the macOS-bundle-like unit an app works in inside a space;\n * the host records which app a folder belongs to (a `.immediately.run/` sidecar),\n * so the picker can surface the app's own projects or let the user create a new\n * one. Observe the granted access via {@link SandboxMount.mode}.\n *\n * Backend-general (§3.5): the picker offers whatever mounts the user has (today,\n * their spaces). Returns the granted mount by its universal id.\n */\nexport const requestMount = (): Promise<SandboxMount> => requestMountInternal('request', {});\n\n/** Prompt the user to grant a mount, returning the granted {@link SandboxMount}.\n *  @deprecated renamed to {@link requestMount} (backend-general, §3.5). */\nexport const requestSpace = requestMount;\n\n// ── content references (plan 12 §E / FILE_SHARING §7) ────────────────────────\n\n/**\n * Build a persisted CONTENT REFERENCE to a file in a mount — a `{mountId, relPath}`\n * pointer your app serializes into ITS OWN content (a board's JSON, an MDX file's\n * frontmatter, an album manifest — the platform doesn't dictate the container) so a\n * later viewer can resolve it. It is exactly the §5.7 {@link capFile} shape: ONE\n * capability, two delivery modes — runtime delegation (a task param, authorized by\n * the caller) vs a durable reference (authorized per-viewer by {@link resolveContentRef}).\n * `relPath` is BACKEND-NATURAL, so the reference resolves to the SAME path for every\n * viewer. Cross-app/cross-project references default to `ro`.\n *\n *   const ref = makeContentRef({ mountId: 'space:ACME', relPath: 'office-seating/desk.mdx' }, { mode: 'ro' });\n *\n * The body repeats {@link capFile} rather than calling it, and that is deliberate:\n * `tasks.ts` registers a host listener at module load, so a VALUE import of it here\n * would run that side effect in every importer of `mounts` (which is why the\n * `FileCap` import above is type-only). The shape the two share is the spec's, and\n * the `FileCap` type is what holds them to it.\n */\nexport const makeContentRef = (ref: { mountId: string; relPath: string }, opts: { mode: 'ro' | 'rw' }): FileCap => ({\n  $cap: 'file',\n  mountId: ref.mountId,\n  relPath: ref.relPath,\n  mode: opts.mode,\n});\n\n/**\n * Resolve a content reference your app found in content it ALREADY holds\n * (FILE_SHARING §7 / UI_AS_APPS §8.7; \"plan 12 §E\"). This is a RELAY, not a\n * fabrication: the host honors it ONLY when your app\n * already holds a grant to `ref.mountId` (else `forbidden`) — apps follow\n * writer-authored links inside granted content; they cannot name a space from\n * nothing (T27). The host runs a per-VIEWER consent prompt (named via the owning\n * app's project sidecar), and existence is never leaked — a decline and a\n * non-existent path are indistinguishable.\n *\n * On allow, the host APPENDS a read scope for the referenced path to your grant\n * (durable; same §8.15 lifecycle) and returns the STABLE absolute `path` the file\n * is mounted at — identical for every viewer, so a path the author stored resolves\n * the same for you. Read it through the `fs` module at that path. Rejects with a\n * {@link SpaceError}: `forbidden` (you don't hold the referenced mount) or\n * `cancelled` (the viewer declined / the path doesn't exist — no oracle).\n *\n *   const { path } = await resolveContentRef(ref);\n *   const text = await fs.promises.readFile(path, 'utf8');\n */\nexport const resolveContentRef = async (ref: FileCap): Promise<{ path: string }> => {\n  const path = await request<string>('resolveRef', { ref });\n  return { path };\n};\n\n/**\n * Resolve a BATCH of content references in ONE consent round (FILE_SHARING §7 /\n * UI_AS_APPS §8.7; \"plan 12 §E\"). When a\n * board opens with several embedded references, pass them all here: the host\n * coalesces them into a SINGLE consent prompt listing every target, instead of one\n * prompt per reference. Same relay gate and per-viewer semantics as\n * {@link resolveContentRef} (each ref's mount must already be held), applied to the\n * whole set — it is all-or-nothing: the user allows the batch or declines it.\n *\n * Resolves `{ paths }` with the STABLE absolute path of each ref, in input order.\n * Rejects with a {@link SpaceError}: `forbidden` (a referenced mount isn't held) or\n * `cancelled` (the viewer declined).\n *\n *   const { paths } = await resolveContentRefs(board.references);\n */\nexport const resolveContentRefs = async (refs: FileCap[]): Promise<{ paths: string[] }> => {\n  const paths = await request<string[]>('resolveRefs', { refs });\n  return { paths };\n};\n\n// ---------------------------------------------------------------------------\n// Settings — the per-user \"~/.config\"-style space (UI_AS_APPS_SPEC §3.3/§3.5/§8.2).\n// Each app gets its OWN settings subdir, auto-provisioned and chroot'd by the host\n// (no dialog, no powerbox). Read/write it through the returned mount's filesystem\n// port — there is deliberately no key/value get/set API; settings are just files.\n// ---------------------------------------------------------------------------\n\n// Issue a `protocol-settings` request, unwrapping {ok,data} and throwing a typed\n// SpaceError on failure (mirrors `request` for the spaces surface).\nconst settingsRequest = async <T = unknown>(method: string, query: Record<string, unknown> = {}): Promise<T> => {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_SETTINGS], method, [query])) as SpaceResult;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'settings request failed') as SpaceError;\n    err.code = (res?.code as SpaceError['code']) ?? 'unknown';\n    throw err;\n  }\n  return res.data as T;\n};\n\n/**\n * Mount this app's per-user settings — a private `~/.config`-style filesystem,\n * auto-provisioned for the signed-in user and isolated to THIS app (the host\n * chroots it; a different app can never name it). Read/write config files through\n * the returned mount. Rejects with a {@link SpaceError} (`auth-required`) when\n * signed out. Capability: baseline `settings:app`.\n *\n * **Which filesystem you get, and when that can change** (R3-413): for an\n * ordinary app — including one holding space grants, powerbox-picked or\n * declared — this is ALWAYS the app-level store (same mount id every call, so\n * \"which space did I pick\" style state survives later grants; no need to open\n * early and keep the handle). The one exception: an instance the host has\n * **floored** below its app tier (the generic-viewer containment,\n * `TRUST_MODES_SPEC` §5) gets a per-origin partition instead — a DIFFERENT\n * filesystem, chosen by the host, that changes when the loaded origin changes\n * and refuses (`forbidden`) when the floor forbids the write. If your app can\n * run floored and needs continuity across origins, keep state per-mount (the\n * returned `SandboxMount.id` tells you which partition you are in).\n */\nexport const openSettings = async (): Promise<SandboxMount> => {\n  const mount = await settingsRequest<SandboxMount>('open');\n  // The host has already accepted the request and announced the mount, so this\n  // normally resolves on the initial replay. Bounded anyway: an unbounded wait\n  // here turns any delivery failure into a promise that never settles, and every\n  // caller of `openSettings()` is doing it to reach durable state — so the app\n  // just quietly loses that state with nothing to report.\n  return waitForMount({ id: mount.id ?? mount.path }, SETTINGS_MOUNT_TIMEOUT_MS);\n};\n\n/** How long `openSettings()` waits for the host to deliver the mount it just\n *  agreed to create. Generous — this is a hang-breaker, not a latency budget. */\nconst SETTINGS_MOUNT_TIMEOUT_MS = 15_000;\n\n/**\n * One-time SEED of this app's settings from the parent it declares as `forkOf`\n * (its `package.json` `immediately.run.forkOf`) — so a fork inherits your\n * preferences from the original app (UI_AS_APPS_SPEC §3.4). The host asks the user\n * to confirm (a full consent when the apps have different owners, a light confirm\n * when the same owner publishes both) and copies the parent's settings into this\n * app's own subdir, skipping any file you already have. Non-throwing: resolves\n * `{ ok:false, code }` on decline (`cancelled`), no declared parent (`forbidden`),\n * or signed-out (`auth-required`). After `{ ok:true }`, read {@link openSettings}.\n * Capability: baseline `settings:fork`.\n */\nexport const importSettingsFromParent = async (): Promise<\n  { ok: true; copied: number } | { ok: false; code: string }\n> => {\n  try {\n    const data = await settingsRequest<{ copied: number }>('importFromParent');\n    return { ok: true, copied: data.copied };\n  } catch (e) {\n    return { ok: false, code: (e as SpaceError).code ?? 'unknown' };\n  }\n};\n\n/**\n * Mount ANOTHER app's per-user settings by its `appKey` — the elevated \"file\n * commander\" surface. Rejects `forbidden` unless this app holds the first-party-\n * only `settings:all` capability. Most apps want {@link openSettings} instead.\n */\nexport const openSettingsOf = async (appKey: string): Promise<SandboxMount> => {\n  const mount = await settingsRequest<SandboxMount>('openOf', { appKey });\n  return waitForMount({ id: mount.id ?? mount.path });\n};\n\n/**\n * List every app that has per-user settings — the elevated \"file commander\"\n * enumeration. Pair with {@link openSettingsOf} to mount any of them. Rejects\n * `forbidden` unless this app holds the first-party-only `settings:all`.\n */\nexport const listSettingsApps = (): Promise<string[]> => settingsRequest<string[]>('list');\n\n/** Create a brand-new, empty platform-hosted space, granted to THIS app in full\n *  (read-write) — the user's create consent is consent for the app to create\n *  storage for itself, and the host records the same durable grant the\n *  {@link requestMount} powerbox would. So the returned mount can be re-opened\n *  later with {@link mountSpace} / {@link mount} (`space:<id>`) with no prompt —\n *  on the next load, in another tab, after sign-out/sign-in — until the user\n *  revokes the grant in their grants surface, after which `mount` answers\n *  `forbidden`. Other apps get nothing: they still reach the space only through\n *  the powerbox. (Before site-main R3-406 no grant was recorded and the space\n *  could only be re-found via the powerbox.) */\nexport const createSpace = (opts: { name?: string } = {}): Promise<SandboxMount> =>\n  requestMountInternal('create', opts);\n\n/** Release a mounted space (stops its listener on the host). */\nexport const unmountSpace = async (query: { spaceId: string }): Promise<void> => {\n  await request('unmount', query);\n};\n\n// ---------------------------------------------------------------------------\n// Space management (the space-manager app) — UI_AS_APPS_SPEC §5.2. These are\n// ELEVATED: enumerating all the user's spaces is `spaces:user`; mutating\n// membership (share/unshare/setRole) and resolving handles is `spaces:admin`.\n// The host enforces the owner-lockout invariant (a space always keeps an owner,\n// T41) and rate-limits handle lookups (L1); the OAuth/identity token never\n// crosses to the app.\n// ---------------------------------------------------------------------------\n\n/** A pending invitation to a space (pull-based sharing, FILE_SHARING_SPEC §6.4).\n *  It grants NO access until accepted — the recipient accepts it from their inbox\n *  ({@link listMyInvites} → {@link acceptInvite}), materializing membership. The\n *  display fields (`name`/`login`/`avatarUrl`) are untrusted for rendering. */\nexport interface Invite {\n  spaceId: string;\n  /** The invitee's uid — carried so the owner's pending list can\n   *  {@link revokeInvite}(spaceId, uid). */\n  uid: string;\n  role: Role;\n  owner: string;\n  name?: string;\n  invitedBy: string;\n  /** epoch ms (server-stamped); absent until the write settles. */\n  invitedAt?: number;\n  login?: string;\n  avatarUrl?: string;\n}\n\n/** The owner's outstanding invitations for a space — `spaces:admin`. */\nexport const listPendingInvites = (spaceId: string): Promise<Invite[]> =>\n  request<Invite[]>('pendingInvites', { spaceId });\n\n/** Withdraw a pending invitation (distinct from {@link unshareSpace}, which removes\n *  an ACCEPTED member) — `spaces:admin`. */\nexport const revokeInvite = async (spaceId: string, uid: string): Promise<void> => {\n  await request('revokeInvite', { spaceId, uid });\n};\n\n/** The caller's OWN invitation inbox — `spaces:user`. */\nexport const listMyInvites = (): Promise<Invite[]> => request<Invite[]>('listInvites', {});\n\n/** Accept an invitation: materialize your membership at the invited role and clear\n *  the invite — `spaces:user`. An invitation the caller doesn't hold rejects with\n *  `forbidden` (indistinguishable from a nonexistent space; no existence oracle). */\nexport const acceptInvite = async (spaceId: string): Promise<void> => {\n  await request('acceptInvite', { spaceId });\n};\n\n/** Decline (dismiss) an invitation from your inbox; writes no membership —\n *  `spaces:user`. */\nexport const declineInvite = async (spaceId: string): Promise<void> => {\n  await request('declineInvite', { spaceId });\n};\n\n// The live invitations inbox (FILE_SHARING §6.4/§9.8): the host pushes the caller's\n// current invitations on change and replays on register-frame; gated `spaces:user`.\n// So an invite that arrives (or an accepted/declined one leaving) reflects within one\n// snapshot — no poll. Mirrors the host's `invitations`/`request-invitations` wiring.\nconst invitesChannel = createPushChannel<Invite[]>({\n  pushType: INVITATIONS,\n  requestType: REQUEST_INVITATIONS,\n  initial: [],\n  parse: (msg) => (Array.isArray(msg.invites) ? (msg.invites as Invite[]) : undefined),\n});\n\n/** The caller's current invitations (`spaces:user`). One-off read; use\n *  {@link onInvitesChange}/{@link useInvites} to react live. */\nexport const getInvites = (): Invite[] => invitesChannel.get();\n\n/** Subscribe to invitation-inbox changes (arrived / accepted / declined). Invoked\n *  immediately with the current list, then on every change. Returns an unsubscribe. */\nexport const onInvitesChange = (listener: (invites: Invite[]) => void): (() => void) =>\n  invitesChannel.onChange(listener);\n\n/** React hook returning the caller's live invitation inbox, re-rendering on change\n *  (the space-manager Invitations inbox, §9.8). */\nexport const useInvites = (): Invite[] => invitesChannel.use();\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAAyB;AAEzB,mBAAoC;AACpC,0BAA0D;AAC1D,yBAAkC;AAClC,yBAA+B;AAC/B,wBAA6B;AAY7B,oBAUO;AAIP,sBAUO;AACP,6BAAwB;AAUjB,MAAM,kBAAkB,UAAc,mCAAe,GAAG,gBAAgB;AA6E/E,MAAM,WAAW,CAAC,MAA4B,EAAE,MAAM,EAAE;AAExD,MAAM,uBAA4C,oBAAI,IAAuB;AAAA,EAC3E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,MAAM,sBAAsB,CAAC,UAC3B,OAAO,UAAU,YAAY,qBAAqB,IAAI,KAAK,IAAK,QAA8B;AAWhG,MAAM,uBAAuB,MAA2B;AACtD,MAAI;AAEF,UAAM,MAAM,QAAQ,YAAY,QAAQ,SAAS;AACjD,WAAO,OAAO,OAAO,IAAI,cAAc,aAAa,MAAM;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,IAAI,eAAoC;AAExC,MAAM,wBAAwB,MAAoB;AAChD,MAAI,aAAc,QAAO;AACzB,MAAI,SAAyB,CAAC;AAC9B,QAAM,YAAY,oBAAI,IAAoD;AAC1E,QAAM,OAAO,CAAC,YAA4B;AACxC,eAAW,KAAK,CAAC,GAAG,SAAS,EAAG,GAAE,QAAQ,OAAO;AAAA,EACnD;AAEA,uCAAY,2BAAW,CAAC,QAA6B;AACnD,UAAMA,SAAkC,IAAI;AAC5C,QAAI,CAACA,OAAO;AACZ,UAAM,MAAM,SAASA,MAAK;AAC1B,aAAS,CAAC,GAAG,OAAO,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,GAAG,GAAGA,MAAK;AAC7D,SAAK,CAAC,CAAC;AAAA,EACT,CAAC;AACD,uCAAY,8BAAc,CAAC,QAA6B;AACtD,UAAM,MAA0B,IAAI,MAAM,IAAI;AAC9C,QAAI,OAAO,KAAM;AACjB,UAAM,SAAS,oBAAoB,IAAI,MAAM;AAC7C,UAAM,UAAU,OAAO,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,EAAE;AACvF,QAAI,QAAQ,WAAW,EAAG;AAC1B,aAAS,OAAO,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,GAAG;AACjD,SAAK,OAAO;AAAA,EACd,CAAC;AAID,MAAI;AACF,yCAAY,8BAAc;AAAA,EAC5B,QAAQ;AAAA,EAER;AAEA,iBAAe;AAAA,IACb,WAAW,MAAM;AAAA,IACjB,UAAU,CAAC,aAAa;AACtB,gBAAU,IAAI,QAAQ;AACtB,eAAS,QAAQ,CAAC,CAAC;AACnB,aAAO,EAAE,SAAS,MAAM,UAAU,OAAO,QAAQ,EAAE;AAAA,IACrD;AAAA,EACF;AACA,SAAO;AACT;AAIA,MAAM,eAAe,MAAoB,qBAAqB,KAAK,sBAAsB;AAMzF,MAAM,UAAU,CAACA,QAAqB,cAA+B,gCAAaA,QAAO,KAAK;AASvF,MAAM,YAAY,MAAsB,aAAa,EAAE,UAAU;AAGjE,MAAM,YAAY,CAAC,UAAgD,UAAU,EAAE,KAAK,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAU5G,MAAM,iBAAiB,CAAC,aAAsF;AACnH,QAAM,aAAa,aAAa,EAAE,SAAS,QAAQ;AACnD,SAAO,MAAM,WAAW,QAAQ;AAClC;AAyBO,MAAM,eAAe,CAAC,OAAmB,cAC9C,mBAAmB,gBAAgB,OAAO,SAAS;AAI9C,MAAM,qBAAqB,CAChC,WACA,OACA,cAEA,IAAI,QAAQ,CAAC,SAAS,WAAW;AAK/B,MAAI;AACJ,MAAI,UAAU;AACd,MAAI;AAGJ,QAAM,OAAO,MAAY;AACvB,cAAU;AACV,QAAI,UAAU,OAAW,cAAa,KAAK;AAC3C,SAAK,QAAQ,QAAQ,EAAE,KAAK,MAAM,cAAc,CAAC;AAAA,EACnD;AACA,gBAAc,UAAU,CAAC,WAAW;AAClC,QAAI,QAAS;AACb,UAAM,QAAQ,OAAO,KAAK,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAClD,QAAI,OAAO;AACT,WAAK;AACL,cAAQ,KAAK;AAAA,IACf;AAAA,EACF,CAAC;AAGD,MAAI,CAAC,WAAW,cAAc,QAAW;AACvC,YAAQ,WAAW,MAAM;AACvB,UAAI,QAAS;AACb,WAAK;AACL,YAAM,MAAM,IAAI;AAAA,QACd,gCAAgC,SAAS,kBAAkB,KAAK,UAAU,KAAK,CAAC;AAAA,MAClF;AACA,UAAI,OAAO;AACX,aAAO,GAAG;AAAA,IACZ,GAAG,SAAS;AAAA,EACd;AACF,CAAC;AAGI,MAAM,YAAY,MAAsB;AAC7C,QAAM,CAAC,QAAQ,SAAS,QAAI,uBAAyB,SAAS;AAC9D,8BAAU,MAAM,eAAe,SAAS,GAAG,CAAC,CAAC;AAC7C,SAAO;AACT;AAsBA,MAAM,2BAAuB,sCAAkC;AAAA,EAC7D,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,CAAC;AAAA,EACV,OAAO,CAAC,QAAS,MAAM,QAAQ,IAAI,MAAM,IAAK,IAAI,SAA4B;AAChF,CAAC;AAKM,MAAM,mBAAmB,MAAsB,qBAAqB,IAAI;AAKxE,MAAM,wBAAwB,CAAC,aACpC,qBAAqB,SAAS,QAAQ;AAKjC,MAAM,mBAAmB,MAAsB,qBAAqB,IAAI;AA0B/E,MAAM,UAAU,OAAoB,QAAgB,QAAiC,CAAC,MAAkB;AACtG,QAAM,MAAO,UAAM,qCAAgB,+BAAQ,+BAAe,GAAG,QAAQ,CAAC,KAAK,CAAC;AAC5E,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,sBAAsB;AAC5D,QAAI,OAAQ,KAAK,QAA+B;AAChD,UAAM;AAAA,EACR;AACA,SAAO,IAAI;AACb;AAKA,MAAM,uBAAuB,OAAO,QAAgB,UAA0D;AAC5G,QAAMA,SAAQ,MAAM,QAAsB,QAAQ,KAAK;AACvD,SAAO,aAAa,EAAE,IAAIA,OAAM,MAAMA,OAAM,KAAK,CAAC;AACpD;AAQO,MAAM,QAAQ,CAAC,YAA2C,qBAAqB,SAAS,EAAE,OAAO,QAAQ,CAAC;AAI1G,MAAM,aAAa,CAAC,UAAsD,MAAM,SAAS,MAAM,OAAO,EAAE;AAqBxG,MAAM,eAAe,MAA6B,qBAAqB,WAAW,CAAC,CAAC;AAIpF,MAAM,eAAe;AAsBrB,MAAM,iBAAiB,CAAC,KAA2C,UAA0C;AAAA,EAClH,MAAM;AAAA,EACN,SAAS,IAAI;AAAA,EACb,SAAS,IAAI;AAAA,EACb,MAAM,KAAK;AACb;AAsBO,MAAM,oBAAoB,OAAO,QAA4C;AAClF,QAAM,OAAO,MAAM,QAAgB,cAAc,EAAE,IAAI,CAAC;AACxD,SAAO,EAAE,KAAK;AAChB;AAiBO,MAAM,qBAAqB,OAAO,SAAkD;AACzF,QAAM,QAAQ,MAAM,QAAkB,eAAe,EAAE,KAAK,CAAC;AAC7D,SAAO,EAAE,MAAM;AACjB;AAWA,MAAM,kBAAkB,OAAoB,QAAgB,QAAiC,CAAC,MAAkB;AAC9G,QAAM,MAAO,UAAM,qCAAgB,+BAAQ,iCAAiB,GAAG,QAAQ,CAAC,KAAK,CAAC;AAC9E,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,yBAAyB;AAC/D,QAAI,OAAQ,KAAK,QAA+B;AAChD,UAAM;AAAA,EACR;AACA,SAAO,IAAI;AACb;AAqBO,MAAM,eAAe,YAAmC;AAC7D,QAAMA,SAAQ,MAAM,gBAA8B,MAAM;AAMxD,SAAO,aAAa,EAAE,IAAIA,OAAM,MAAMA,OAAM,KAAK,GAAG,yBAAyB;AAC/E;AAIA,MAAM,4BAA4B;AAa3B,MAAM,2BAA2B,YAEnC;AACH,MAAI;AACF,UAAM,OAAO,MAAM,gBAAoC,kBAAkB;AACzE,WAAO,EAAE,IAAI,MAAM,QAAQ,KAAK,OAAO;AAAA,EACzC,SAAS,GAAG;AACV,WAAO,EAAE,IAAI,OAAO,MAAO,EAAiB,QAAQ,UAAU;AAAA,EAChE;AACF;AAOO,MAAM,iBAAiB,OAAO,WAA0C;AAC7E,QAAMA,SAAQ,MAAM,gBAA8B,UAAU,EAAE,OAAO,CAAC;AACtE,SAAO,aAAa,EAAE,IAAIA,OAAM,MAAMA,OAAM,KAAK,CAAC;AACpD;AAOO,MAAM,mBAAmB,MAAyB,gBAA0B,MAAM;AAYlF,MAAM,cAAc,CAAC,OAA0B,CAAC,MACrD,qBAAqB,UAAU,IAAI;AAG9B,MAAM,eAAe,OAAO,UAA8C;AAC/E,QAAM,QAAQ,WAAW,KAAK;AAChC;AA+BO,MAAM,qBAAqB,CAAC,YACjC,QAAkB,kBAAkB,EAAE,QAAQ,CAAC;AAI1C,MAAM,eAAe,OAAO,SAAiB,QAA+B;AACjF,QAAM,QAAQ,gBAAgB,EAAE,SAAS,IAAI,CAAC;AAChD;AAGO,MAAM,gBAAgB,MAAyB,QAAkB,eAAe,CAAC,CAAC;AAKlF,MAAM,eAAe,OAAO,YAAmC;AACpE,QAAM,QAAQ,gBAAgB,EAAE,QAAQ,CAAC;AAC3C;AAIO,MAAM,gBAAgB,OAAO,YAAmC;AACrE,QAAM,QAAQ,iBAAiB,EAAE,QAAQ,CAAC;AAC5C;AAMA,MAAM,qBAAiB,sCAA4B;AAAA,EACjD,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,CAAC;AAAA,EACV,OAAO,CAAC,QAAS,MAAM,QAAQ,IAAI,OAAO,IAAK,IAAI,UAAuB;AAC5E,CAAC;AAIM,MAAM,aAAa,MAAgB,eAAe,IAAI;AAItD,MAAM,kBAAkB,CAAC,aAC9B,eAAe,SAAS,QAAQ;AAI3B,MAAM,aAAa,MAAgB,eAAe,IAAI;","names":["mount"]}